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HEALTHCARE.GOV: A REVIEW OF 
OPERATIONS AND ENROLLMENT 


THURSDAY, MARCH 17, 2016 

U.S. Senate, 
Committee on Finance, 

Washington, DC. 

The hearing was convened, pursuant to notice, at 10:03 a.m., in 
room SD-215, Dirksen Senate Office Building, Hon. Orrin G. Hatch 
(chairman of the committee) presiding. 

Present: Senators Burr, Isakson, Coats, Heller, Scott, Wyden, 
Stabenow, Brown, and Bennet. 

Also present: Republican Staff: Chris Campbell, Staff Director; 
Christopher Armstrong, Deputy Chief Oversight Counsel; Kimberly 
Brandt, Chief Health-care Investigative Counsel; and Jill Wright, 
Detailee. Democratic Staff: Joshua Sheinkman, Staff Director; 
David Berick, Chief Investigator; Elizabeth Jurinka, Chief Health 
Advisor; and Juan Machado, Professional Staff Member. 

OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. 

SENATOR FROM UTAH, CHAIRMAN, COMMITTEE ON FINANCE 

The Chairman. The committee will come to order. It has been a 
little bit disruptive here this morning. We have a lot on our plate. 
It is a pleasure to welcome everybody here this morning. 

Today, we will be talking with representatives from the Office of 
Inspector General for the Department of Health and Human Serv- 
ices and from the Government Accountability Office about their on- 
going oversight work with respect to HealthCare.gov and enroll- 
ment in the Federal health insurance marketplace. I want to thank 
both entities for their hard work on these issues and acknowledge 
the contributions both have made to help this committee perform 
more accurate and timely oversight. 

Now, it is no secret that I have never been a fan of the so-called 
Affordable Care Act, and, as we approach the sixth anniversary of 
this law and look closely into how it is working and being imple- 
mented, the evidence overwhelmingly shows that I and the many 
others who opposed the law from the beginning have been right all 
along. 

The facts speak for themselves. Since Obamacare was signed into 
law, HHS/OIG and GAO have cumulatively released at least six 
dozen reports detailing various operation and implementation is- 
sues, demonstrating the numerous areas where the law is falling 
short. These reports are specific and focused on key operational 
failures, like enrollment controls or system issues, some of which 
we will hear more about today. 


( 1 ) 



2 


Let us keep in mind that GAO and HHS/OIG are not partisan 
entities. They are independent watchdogs tasked with the responsi- 
bility of objectively and dispassionately assessing what is and what 
is not working in various Federal programs, including those cre- 
ated or amended by the Affordable Care Act. And there is no better 
record showing how this happened than the reports we received 
from these offices. 

Today, we are going to specifically discuss operations issues re- 
lated to HealthCare.gov and enrollment problems at the Federal in- 
surance marketplace, otherwise known as the Federal exchange. 

Let us start with the HealthCare.gov launch. As a result of nu- 
merous problems and shortcuts taken with the initial development 
and deployment of HealthCare.gov and its supporting systems, con- 
sumers encountered widespread performance issues when trying to 
create accounts and enroll in health plans. 

After numerous inquiries and reports, we now know what ulti- 
mately caused these performance issues. For example, there was 
inadequate capacity planning. The Centers for Medicare and Med- 
icaid Services, CMS, cut corners and did not plan for adequate ca- 
pacity to maintain HealthCare.gov and its supporting systems. 

There were also problems with the software that were entirely 
avoidable. CMS and its contractors identified errors in the software 
coding for the website, but did not adequately correct them prior 
to the launch, and we saw a lack of functionality as CMS did not 
adequately prepare the necessary systems and functions of the 
website and its supporting systems prior to the initial launch. 

CMS also failed to apply recognized best practices for system de- 
velopment, which contributed to the problem. Admittedly, since the 
initial launch, CMS has taken steps to address these problems, in- 
cluding increasing capacity, requiring additional software quality 
reviews, and awarding a new contract to complete development and 
improve the functionality of key systems. However, many of the 
problems have still not been entirely resolved and continue to 
cause frustration, especially for consumers trying to obtain health 
insurance. 

I wish we could boil down all of Obamacare’s problems to the 
functions of a single website. Indeed, if this was just an IT prob- 
lem, all of our jobs would be a lot easier. However, the problems 
with Obamacare, and the Federal insurance marketplace in par- 
ticular, go much deeper, and many of them remain unaddressed. 

We know, for example, that the enrollment controls for the Fed- 
eral marketplace have been inadequate. During undercover testing 
by GAO, the Federal marketplace approved insurance coverage 
with taxpayer-funded subsidies for 11 out of 12 fictitious phone or 
online applicants. In 2014, the GAO applicants — which, once again, 
were fake, made-up people — obtained a total of about $30,000 in 
annual advanced premium tax credits, plus eligibility for lower in- 
surance costs at the time of the service. These fictitious enrollees 
maintained subsidized coverage throughout the year even though 
GAO sent either clearly fabricated documents or no documents at 
all to resolve the application inconsistencies. 

While the subsidies, including those granted to GAO’s fictitious 
applicants, are paid to health-care insurers, they nevertheless rep- 
resent a benefit to consumers and a cost to the government. 
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Now, GAO did find that CMS relies on a contractor charged with 
document processing to basically uncover and report possible in- 
stances of fraud. Yet, GAO also found that the agency does not re- 
quire that the contractor have any fraud detection capability. 

According to GAO, CMS has not performed a single comprehen- 
sive fraud risk assessment — the recommended best practice — of the 
Obamacare enrollment and eligibility process. Until such assess- 
ment is completed, CMS is unlikely to know whether existing con- 
trol activities are suitably designed and implemented to reduce in- 
herent fraud risk to an acceptable level. In other words, CMS is not 
even sure if CMS’s fraud prevention systems are designed correctly 
or if they are effective. 

Lastly, while it is not the focus of the reports that will be covered 
by the testimony today, another matter we have been tracking 
closely and where the GAO is issuing a report today is CMS’s over- 
sight of the health care CO-OPs. We had a hearing on this topic 
in late January, where we examined a number of financial and 
oversight-related explanations for the abject failure of the CO-OP 
programs. 

Today’s GAO report describes CMS’s efforts to deal with financial 
or operations issues at the CO-OPs, including the use of an esca- 
lation plan for CO-OPs with serious problems that may require cor- 
rective actions or enhanced oversight. 

As of November 2015, 18 CO-OPs had enough problems that they 
had to submit to a CMS escalation plan, including nine that have 
discontinued operation. And just last week, we heard that yet an- 
other CO-OP, this time the one in Maine, is on the verge of finan- 
cial insolvency, despite the fact that it had been on a CMS- 
mandated escalation plan. 

In other words, CMS’s efforts to address all the problems faced 
by CO-OPs appear to have failed, just like virtually every other ele- 
ment of this program. The failure of CMS to adequately implement 
the CO-OP program is well-documented here on the Finance Com- 
mittee and elsewhere. As with so many other parts of Obamacare, 
the high-minded rhetoric surrounding this program has fallen short 
of reality. 

With nearly half of the CO-OPs now closed, the failed experiment 
has wasted taxpayer dollars and forced patients and families to 
scramble for new insurance. With so many CO-OPs now in finan- 
cial jeopardy, I believe that CMS should work with and not against 
States to safeguard taxpayer dollars. 

So as always, we have a lot to discuss, and I look forward to 
hearing more from the officials we have testifying here today. 

So with that, I will turn to Senator Wyden for his opening re- 
marks. 

[The prepared statement of Chairman Hatch appears in the ap- 
pendix.] 

OPENING STATEMENT OF HON. RON WYDEN, 

A U.S. SENATOR FROM OREGON 

Senator Wyden. Thank you, Mr. Chairman. 

Mr. Chairman and colleagues, it is old news that the initial roll- 
out of HealthCare.gov 3 years ago was botched. It is new news that 
the Inspector General of the Health and Human Services Depart- 



4 


ment recently said, and I want to quote here — this is a quote, col- 
leagues, from the Inspector General: “CMS recovered the Health- 
Care. gov website for high consumer use within 2 months and 
adopted more effective organizational practices.” That is what the 
Inspector General said, that the Department recovered the website 
for high consumer use within 2 months. That quote comes from one 
of two reports looking back at 2013 and 2014 that the Finance 
Committee will be presented with today. 

I think we ought to start by recognizing that the story here is 
well-documented. After the launch went badly, some of the best 
minds in technology and a new contractor were brought in. They 
scrambled to overhaul the system, and the exchange was soon up 
and running, and the Centers for Medicare and Medicaid Services 
are now following up on each of the Inspector General’s rec- 
ommendations, which the Inspector General notes in its report. 

In the most recent enrollment period, nearly 10 million Ameri- 
cans used HealthCare.gov to sign up for a plan or reenroll auto- 
matically. In my home State, which had its own problems, close to 

150.000 people have used the website to sign up for a plan as of 
January 31st. That is up by more than 30 percent compared to last 
year. 

The committee will also hear an update from the Government 
Accountability Office on what has been called the secret shopper 
investigation. The Government Accountability Office first brought 
this study before the committee in July of last year. I am going to 
repeat what I said back then. 

On this side of the aisle, we do not take a back seat to anybody 
in fighting fraud and protecting taxpayer dollars — $1 ripped off is 
$1 too many. But let us recognize that what was true last summer 
remains true today. 

This GAO investigation has not uncovered one single shred of 
real-world fraud in the insurance marketplace. It was built on ficti- 
tious characters with specially created identities, not real con- 
sumers and not real fraudsters. It is true that the Government Ac- 
countability Office found that there are sometimes differences be- 
tween the information on somebody’s insurance application and 
their tax forms and citizenship records. But when it comes to these 
inconsistencies in people’s data, this investigation cannot differen- 
tiate between fraud and a typo. 

Meanwhile, Health and Human Services does not look the other 
way when it finds the red flags. In 2014, the year of GAO’s inves- 
tigation, the Centers for Medicare and Medicaid Services closed 
more than 100,000 insurance policies because documents did not 
match or were not provided. Tax credits were adjusted for nearly 

100.000 households. In 2015, Health and Human Services closed 
more policies and adjusted more tax credits. 

If you come at this from the left, you might say that is too harsh. 
If you come at it from the right, you might take a different view. 
But there is no basis whatsoever for the argument that Health and 
Human Services ignores problems in people’s records or leaves the 
door open to fraud. It seems to me, rather than rehashing old news, 
we ought to be looking at the facts and talking in a bipartisan way 
about how to move forward together. 
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Because of the Affordable Care Act, the number of Americans 
without health insurance is at or near its lowest point in half a 
century. For the 160 million people who get their insurance from 
their employer, colleagues, premiums climbed 4 percent last year. 
Let me repeat that. For 160 million people who get their insurance 
from their employer, premiums climbed only 4 percent. Working- 
age Americans in Oregon and nationwide with preexisting condi- 
tions — 80 million people or more — can no longer be denied insur- 
ance. 

So, instead of battling out what happened 3 years ago, we ought 
to be pulling on the same end of the rope and solving some prob- 
lems. For example. Democrats and Republicans ought to be work- 
ing together to look at ways in which we can provide even more 
competition and bring costs down for consumers, and a lot of you 
in this room have worked with me on that issue for some time. 

Second, there are going to be spectacular new cures in the future, 
and there are real questions as to whether our health-care system 
is going to be able to afford them. Here, Senator Grassley has 
worked very closely with me to put together a bipartisan case 
study, which looked at one blockbuster drug involving hepatitis C. 
Solving the cost of these blockbuster drugs is going to take a lot 
of hard work. It, again, can only be done on a bipartisan basis. 

Finally, I want to express my appreciation to colleagues on both 
sides of the aisle, because I think we are on the cusp of being able 
to make real progress on a huge opportunity for older people in our 
country, and that is protecting the Medicare guarantee, this very 
sacred guarantee we have for seniors, while updating the program 
to look at the great new challenge, which is chronic illness. 

I want to thank Senator Bennet, who was out in front on this 
issue for some time. He is not here, but Senator Isakson and Sen- 
ator Warner were champions as well. I want to express my appre- 
ciation to the chairman for the progress that we are making. 

I have to make some comments with respect to something we did 
not know about until about an hour ago, and that is this matter 
of the CO-OPs. 

What we have said is that we want to work in a bipartisan way 
to improve a variety of sections of the Affordable Care Act. Now, 
this new material on the CO-OPs, which neither I nor anyone on 
this side knew anything about, was available something like an 
hour ago. I intend to look at it with an eye to what can be done 
on a bipartisan basis going forward. 

But my work, and I think the work of colleagues here, always 
ought to come back to this idea of making health-care policy more 
accessible and more affordable. And for now — and I certainly have 
not seen this report — I am not going to be participating in any cele- 
bration of people suffering, because the CO-OPs were tied up in a 
congressionally induced economic straightjacket. 

Thank you, Mr. Chairman. 

[The prepared statement of Senator Wyden appears in the ap- 
pendix.] 

The Chairman. Thank you. Senator. 

I am going to introduce today’s witnesses. Our first witness is 
Ms. Erin Bliss, the Assistant Inspector General for Evaluation and 
Inspections in the Office of Inspector General, or OIG, at HHS. 
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Ms. Bliss has served in many roles at OIG since her career 
began. I think your career began in 2000, if I have it correctly. She 
started as an analyst for the Office of Evaluation and Inspections 
and later went on to serve as a senior advisor, where she provided 
management advice and expert analysis to the Inspector General 
and other senior executives on programmatic priorities and inter- 
nal policies and operations. 

Afterwards, she worked from 2009 to 2014 as Director of Exter- 
nal Affairs at OIG and was responsible for overseeing and imple- 
menting OIG’s communication strategies and relationship manage- 
ment with the administration. Congress, media, the health-care in- 
dustry and providers, and the public. 

Ms. Bliss received her bachelor’s degree in government from the 
University of Notre Dame before receiving her master’s degree in 
public policy from the University of Chicago. 

Our second witness is Mr. Seto Bagdoyan, the Director for Audit 
Services in GAO’s Forensics, Audits, and Investigative Service Mis- 
sion Team. During his GAO career, Mr. Bagdoyan has served in a 
variety of positions, including as Legislative Advisor in the Office 
of Congressional Relations and as Assistant Director for Homeland 
Security in Justice. 

Mr. Bagdoyan has also served on congressional details with the 
Senate Finance Committee and the House Committee on Homeland 
Security. We are glad to see you back here again. 

Mr. Bagdoyan has also held a number of senior positions in con- 
sultancies in the private sector, including most recently focusing on 
political risk in homeland security. 

Mr. Bagdoyan received his bachelor’s degree in international re- 
lations and economics from Claremont McKenna College and an 
MBA in strategy from Pepperdine University. 

I want to thank you both for coming. We will hear the witness 
testimonies in the order that they were introduced. 

Ms. Bliss, please proceed with your 5-minute statement. 

STATEMENT OF ERIN BLISS, ASSISTANT INSPECTOR GENERAL 

FOR EVALUATION AND INSPECTIONS, OFFICE OF INSPEC- 
TOR GENERAL, DEPARTMENT OF HEALTH AND HUMAN 

SERVICES, WASHINGTON, DC 

Ms. Bliss. Thank you. Good morning. Chairman Hatch and other 
distinguished members of the committee. Thank you for the oppor- 
tunity to testify today about the Office of Inspector General’s case 
study which examines the management of HealthCare.gov . 

This is the website consumers use to apply for health insurance 
through the Federal marketplace. As is well known, on October 1, 
2013, the HealthCare.gov website failed almost immediately upon 
launch. Yet, within 2 months, CMS had substantially improved the 
site’s performance. 

How did such a high priority project start so poorly, and how did 
CMS turn the website around? Our case study provides insights 
into these questions and lessons learned to help HealthCare.gov 
and other Federal projects work better. 

We believe that our assessment of the intersection of technology, 
policy, and management can benefit a broad range of Federal proj- 
ects and programs. Our report chronicles the breakdown and turn- 
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around of HealthCare.gov over a 5-year period. This morning I will 
summarize the highlights. 

From the outset, the HealthCare.gov project faced a high risk of 
failure. It was technically complex, with a fixed deadline and many 
uncertainties. Still, HHS and CMS made many missteps in its im- 
plementation. Most critical was the absence of clear leadership and 
overall project responsibility, which had ripple effects. 

Policy decisions were delayed, affecting the technical decisions. 
Policy and technical staff were in silos and not well-coordinated, 
and contract management was disjointed. Changes to the project 
were not well-documented and progress not adequately monitored. 

This culminated in CMS not fully communicating or acting upon 
many warnings of problems before the launch. CMS failed to fully 
grasp the poor status of the build. One reason was that no one had 
a full view into all of the problems and how they fit together. 

Red flags raised to leadership did not always flow to staff work- 
ing on the build, and staff did not always alert leadership to prob- 
lems on the front lines. CMS was unduly optimistic. 

Last-minute attempts to correct problems were rushed and insuf- 
ficient. In the 2 months before the launch, CMS added twice the 
staff to the project and cut many planned website functions. And 
just 72 hours ahead, CMS asked its contractor to double its com- 
puting capacity. 

Even with these efforts, the HealthCare.gov website experienced 
major problems within hours of its launch. The website received 
five times the number of expected users, but the problems went be- 
yond capacity. The website entry tool worked poorly, and software 
coding defects caused malfunctions. CMS and its contractors did 
not have coordinated tools to diagnose these problems. However, 
CMS pivoted quickly to make corrections to the website. They 
brought in additional staff and expertise from across government 
and the private sector. 

One key was creating a badgeless culture, where Federal employ- 
ees and contractors worked together as a team. CMS designated 
clear leadership, integrated policy and technical staff, and devel- 
oped redundant systems to avoid future website problems. 

CMS also took a more realistic approach to building website 
functions. It practiced what officials called ruthless prioritization, 
which focused on effectively developing the most critical functions, 
like reenrollment, and delaying other features. They measured 
progress and monitored problems to respond more quickly and ef- 
fectively. These factors contributed to an improved website and im- 
portant organizational changes. 

Looking ahead, CMS continues to face challenges in improving 
HealthCare.gov and managing the Federal marketplace. This in- 
cludes addressing more than 30 recommendations from OIG’s other 
Federal marketplace reports. We will continue to monitor CMS’s 
actions in response to our recommendations and its overall man- 
agement of this and other programs. 

Thank you again for inviting OIG to speak with the committee 
today, and I will be happy to answer your questions. 

[The prepared statement of Ms. Bliss appears in the appendix.] 

The Chairman. Thank you so much. 

Mr. Bagdoyan, we will turn to you. 
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STATEMENT OF SETO J. BAGDOYAN, DIRECTOR OF AUDITS, 

FORENSIC AUDITS AND INVESTIGATIVE SERVICE, GOVERN- 
MENT ACCOUNTABILITY OFFICE, WASHINGTON, DC 

Mr. Bagdoyan. Good morning, Chairman Hatch, Ranking Mem- 
ber Wyden, and members of the committee. I am pleased to be here 
today to discuss results from our February 2016 report on enroll- 
ment and verification controls for ACA health-care coverage ob- 
tained through the Federal marketplace during the 2014 open en- 
rollment period. 

Our results are based on extensive forensic analyses of relevant 
data from CMS and other agencies, such as SSA, IRS, and DHS — 
involving originally the entire 2014 applicant and enrollee uni- 
verse — and are independent of the undercover work we performed 
for that period. 

A central feature of ACA’s enrollment controls is the Federal 
data services hub, which is the primary vehicle for CMS to initially 
check information provided by applicants against various Federal 
data sources. In addition, the ACA established a process to resolve 
inconsistencies, i.e., instances where applicant information does not 
match that from marketplace sources. 

In terms of context for our work, coverage offered through the 
Federal marketplace is a significant expenditure for the Federal 
Government. Current levels of coverage involve millions of enroll- 
ees, of whom about 85 percent receive subsidies. CBO has esti- 
mated Fed subsidy costs at about $880 billion for fiscal years 2016 
through 2025. 

I would note that while subsidies are paid to insurers and not 
directly to enrollees, they nevertheless represent a financial benefit 
to them. As I have stressed before, a program of this scope and 
scale remains inherently at risk for errors, including improper pay- 
ment and fraud. Accordingly, it is essential that effective enroll- 
ment controls are in place to help narrow the window of oppor- 
tunity for such risk and safeguard the government’s investment. 

Against this backdrop, I will now discuss our two principal ana- 
lytical results. 

First, we found that CMS does not track or analyze aggregate 
outcomes of data hub inquiries or the extent to which a queried 
agency delivers information responsive to a request or whether an 
agency reports that that information was not available. 

In this regard, for example, we found that SSA could not match 
4.3 million queries related to names, dates of birth, or Social Secu- 
rity numbers, and 8.2 million queries related to citizenship claims. 
IRS could not match queries involving about 31 million people re- 
lated to income and family size, and, within this, 1.3 million people 
had ID theft issues. Finally, DHS could not match 510,000 queries 
related to citizenship and immigration status. 

Accordingly, CMS foregoes opportunities for gaining valuable in- 
sights about significant program integrity issues, including vulner- 
abilities to potential fraud, as well as information useful for en- 
hancing overall program management. 

Second, we found that CMS did not have an effective process for 
resolving inconsistencies for applicants using the Federal market- 
place. For example, we found that about 431,000 applications, with 
about $1.7 billion in associated subsidies, still had about 679,000 
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inconsistencies unresolved as of April 2015. That is 4 months after 
the close of the 2014 coverage year. 

Within these, CMS did not resolve Social Security number incon- 
sistencies for about 35,000 applications, with about $154 million in 
associated subsidies, or incarceration inconsistencies for about 
22,000 applications, with about $68 million in associated subsidies. 

By leaving inconsistencies unresolved, CMS risks granting eligi- 
bility to and making subsidy payments on behalf of individuals who 
are ineligible to enroll in qualified health plans. One important ex- 
ample emphasizes this point. According to IRS, accurate data are 
vital for income tax compliance and the reconciliation of advanced 
premium tax credits through filing tax returns, which is a key 
backend control under ACA. 

In closing, our work to date collectively shows that CMS has as- 
sumed a generally passive approach to managing fraud risks in 
ACA, weakening the program’s integrity. Accordingly, we continue 
to underscore that CMS needs to make ACA program integrity a 
priority and implement effective controls to help reduce improper 
payment and fraud risks and preclude them from being embedded 
early in the program’s life cycle. 

In this regard, we made eight recommendations to CMS in our 
February report, which are intended to help mitigate the vulner- 
abilities and risks we identified. While the agency agreed with the 
recommendations, it is incumbent on CMS to implement them in 
a timely fashion and achieve and sustain measurable results. 

Mr. Chairman, this concludes my statement. I look forward to 
the committee’s questions, and I appreciate the indulgence for an 
extra 30 seconds. 

[The prepared statement of Mr. Bagdoyan appears in the appen- 
dix.] 

The Chairman. I am happy to give you that extra time. 

Ms. Bliss, previous reports at the Office of Inspector General 
criticized HealthCare.gov and the marketplace, describing impor- 
tant problems with internal controls, such as inadequate proce- 
dures for checking the eligibility of enrollees. 

How does the case study differ from previous reports of the Office 
of Inspector General on the same topic? 

Ms. Bliss. Thank you for your question, Mr. Chairman. The case 
study is one of a dozen reports that OIG has issued on the Federal 
marketplaces. Most of those were more-targeted audits or evalua- 
tions examining aspects of eligibility controls, payment accuracy, 
contracting, and security of information. 

The case study took a different approach and cast a wide lens at 
CMS’s management of the project in its entirety, from multiple per- 
spectives and over a long period of time, in order to glean lessons 
learned about what went wrong and what went right in an effort 
to help improve both this HealthCare.gov project and other Federal 
projects moving forward. 

The Chairman. Thank you. 

Mr. Bagdoyan, your report pointed out the key role played by 
the, quote, “data services hub,” which is the electronic clearing- 
house for checking applicant information against Federal data- 
bases. 
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Now, you said that CMS needs to make better use of this impor- 
tant enrollment control process. Would you explain that a little bit? 

Mr. Bagdoyan. I would be happy to do that, Mr. Chairman. 

Basically, the data hub is a key cog, if you will, in the overall 
control environment for ACA. It is up-front. It processes a lot of 
queries for information. A lot of those queries — all of those queries, 
in fact, are not captured for future analysis. 

We believe that such capture and analysis would provide CMS 
with a lot of insight into potential indicators of improper payments, 
as well as fraud. So a comprehensive control system would theo- 
retically enable that sort of analysis for the long term, and we do 
actually have a recommendation to that effect to CMS. 

The Chairman. Thank you. We have been long told by CMS, “Do 
not worry. Even if there are issues with awarding subsidies, every- 
thing eventually gets fixed when people file their income taxes.” 

The GAO found practices that undermine tax compliance. Am I 
right about that? 

Mr. Bagdoyan. Yes. We identified a number of inconsistencies. 
Out of the 431,000, I believe we had about 35,000 that involved tax 
or SSN inconsistencies. And according to IRS, when we discussed 
this at length, they told us that this was not only important for tax 
compliance purposes, but also for the tax reconciliation process to 
reconcile the advanced premium tax credits at the end. 

This is the third main back-end control, if you will, in the overall 
setup. So without that information that is accurate and reliable, 
IRS pointed out that their job is made much more difficult, not only 
to do the tax return processing, but also to reconcile the subsidies. 

So it is a long-term problem if it is not addressed. 

The Chairman. All right. Ms. Bliss, what are the most important 
lessons learned from HealthCare.gov for the administration, and do 
you think that the lessons learned from your case study apply to 
other large programs and projects, whether being planned by the 
Department of Health and Human Services or other government 
agencies? 

Ms. Bliss. Thank you. We certainly do. The intersection between 
policy, technology, and management is not only essential for 
HealthCare.gov, but we believe these lessons will apply to other 
Federal projects and Federal programs. 

We gleaned 10 lessons learned, and I will highlight what I be- 
lieve to be the three most significant. 

First is establishing clear leadership. We found that the lack of 
clear leadership in overall responsibility and clear lines of delega- 
tion had ripple effects, caused a number of cascading problems 
across the project, and made problem resolution more difficult. 

We also found that a disconnect between those working on the 
policy and making decisions and those working on the technical as- 
pects of the project created problems on both sides. And delays in 
policy decision-making compressed an already tight time frame for 
achieving the technical build successfully. 

So, better integration across lines of business, policy, and tech- 
nical, as well as across government and contractors through this 
badgeless culture, are some of the keys we saw to correction and 
success. 
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And then, finally, taking a posture of continuous learning is es- 
sential, which means being flexible and adaptable, especially with 
a startup-type project like HealthCare.gov was. We found that CMS 
got stuck on an unwinnable path, and it was too late before they 
realized it and tried to make changes. 

So keeping that continuous learning posture, being innovative 
and flexible, and constantly monitoring for problems to adjust 
plans where needed are all important. 

Thank you. 

The Chairman. Thank you. 

Senator Stabenow, we will turn to you. 

Senator Stabenow. Thank you very much, Mr. Chairman. And 
welcome and thank you to both of you. 

Ms. Bliss, I am wondering — to start, just a “yes” or “no” question. 
Based on your case study, do you think that the HealthCare.gov 
website should be taken down and a completely new website be 
built? 

Ms. Bliss. No. 

Senator Stabenow. Thank you. Like many of my colleagues, we 
were very frustrated about what happened in the past, and clearly 
you have laid out the problems with the launch, and I think every- 
one agrees that there were serious problems with the launch of 
HealthCare.gov and it created a lot of difficulties, and certainly for 
people in Michigan, to get coverage in 2013. 

But that was 3 years ago, and we are now in year 3 of the Af- 
fordable Care Act marketplace operations. So when we look at the 
report, the report is really looking backwards, and we can agree 
there were problems. 

The question is moving forward and how do we ignore the fact 
that over 20 million people have received health-care coverage be- 
cause of the Affordable Care Act, literally saving people’s lives? 
That is not just a rhetorical statement. I have talked to people who 
were able to get surgery or were able to get care for their children 
that they have never been able to receive before and save lives, and 
I think that is a good part of things when we talk about the num- 
bers, the real-life experiences of people. 

The un-insurance rate is the lowest it has ever been, and Med- 
icaid expansion has resulted in literally millions of our most vul- 
nerable families receiving the care that they deserve. 

So, given the fact that the AC A is the law of the land and it is 
our responsibility to make it better, I first want to say that I hope 
that all of us will work on how to make it better, and that is why 
we appreciate your recommendations as we look forward, not just 
in the case of this particular website and process, but others as 
well. 

But the question is, how do we make it better? So we want to 
make sure that we have quality access to health care for every 
American, whether it is Medicare, Medicaid, the Children’s Health 
Program, and so on and so on. 

So with that in mind, Mr. Bagdoyan, let me ask about any other 
recommendations from a GAO standpoint that you have not al- 
ready spoken of today on how we can make these better, because, 
frankly, I want the over 20 million people who have health insur- 
ance today who did not have it before to have the peace of mind 
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going to bed at night of knowing they are going to be able to take 
their children to a doctor if they get sick. I want to keep that. And 
I am hopeful we can even get as close to zero as possible in terms 
of the number of people in our country who do not have access to 
health care. 

So I am interested in your recommendations on how we go for- 
ward to work together to make this system work better. 

Mr. Bagdoyan. Sure. Thank you for your question, Senator 
Stabenow. 

As you mentioned, we operate under the premise that this is the 
law on the books, and my charge is to help make it work as in- 
tended. With that in mind, our report makes eight specific rec- 
ommendations. We try not to be too prescriptive to allow CMS 
some latitude to explore various options. 

However, the key recommendation, I believe, the big-picture rec- 
ommendation, is for CMS to conduct a comprehensive risk assess- 
ment of the entire program, sort of top to bottom, and identify the 
control vulnerabilities and the risks for improper payments and 
fraud. 

In that regard, GAO issued, in July of 2015, its framework for 
managing fraud risk in Federal programs. So that is a comprehen- 
sive leading practice compilation from the private and public sec- 
tors that would provide the agency with quite a solid roadmap to 
perform that risk assessment. 

So everything should flow from that assessment in terms of the 
types of actions, policy changes, control improvements, and so 
forth. 

Senator Stabenow. And are you working with CMS? What is 
their reaction on this? Are they objecting to that? 

Mr. Bagdoyan. No. I think I should give CMS credit that they 
accepted all eight recommendations, including this one. But as they 
say, the proof is in the pudding. They need to execute, do so suc- 
cessfully, and then achieve results and sustain them over the long 
term. This is not a one-and-done proposition by any means. 

Senator Stabenow. Sure. So just to be clear, you have made the 
recommendations. They have accepted all eight recommendations, 
and they are in the process of doing them. 

Mr. Bagdoyan. That is correct. We had informal discussions, as 
well as the formal letter responding to our recommendations. 

Senator Stabenow. Thank you, Mr. Chairman. 

The Chairman. Senator Coats? 

Senator Coats. Thank you, Mr. Chairman. And I want to thank 
our two witnesses. 

Lord knows where we would be if we did not have GAO and In- 
spectors General. The alarming malfeasance and incompetence of 
the rollout of this plan is just stunning. And here we are, we can- 
not just simply brush it off and say, well, this was a bad start, but 
everything is going great now. 

On the cost to the taxpayer, probably we will never know. But 
thank goodness that we have your organizations providing us infor- 
mation and spurring on a seemingly bureaucratic nightmare that 
exists within the Federal Government in terms of handling these 
kinds of programs. 
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Anybody in the private sector who had done this would have 
been bankrupt; investors would have lost all their money. It is just 
stunning to continue to observe what it takes to get these agencies 
to — I think they are well-intended, they are just overwhelmed in 
terms of the complexity of getting this done. 

I go the floor of the Senate every week and talk about a waste 
of the week, and, Mr. Bagdoyan, I have referenced your name, not 
as part of the problem, but as part of the solution. And the infor- 
mation that you have provided here for me continues to stun people 
when they hear about some of the incompetency. 

I was particularly interested, because I think it speaks to a big- 
ger problem, in your, what was called the secret shopper investiga- 
tion, where you deliberately made applications as a test — you made 
applications for compliance with the Affordable Care Act and re- 
ceiving subsidies. And 11 of the 12 — I think my numbers are 
right — everything you submitted was fraudulent, but 11 of the 12 
were accepted. And even after it was revealed that they were ac- 
cepted, follow-up phone calls, pretending to be that person who was 
given notice that they were not eligible, were accepted. 

That percentage is pretty high, and if you multiply that out, it 
just really makes you wonder if this whole thing was not gamed 
or at least so intent on providing numbers to make it look success- 
ful that we really were not getting the information, the verification, 
that we needed. 

Then there was the question with CMS at one point releasing a 
statement, “Well, we are not in the verification business.” I think 
basically what you just said was that they are now taking a dif- 
ferent stand on that. 

But I wonder if you could respond to where are we now in terms 
of verification capacity so that we do not have this fraudulent and 
wasteful situation moving on. I am happy to have either one of you 
or both of you address that. But it just seems easy: an evaluation 
of Social Security numbers to determine their validity would make 
it fairly easy to make a determination as to whether they qualify 
or whether they do not qualify. 

But where is CMS in terms of putting that process in place, and 
what is the success to date of that process? 

Mr. Bagdoyan. Sure. If I may, Ms. Bliss, take first crack on that. 

First, I appreciate the plug on the floor. Senator. 

Senator Coats. Sure. [Laughter.] 

Keep sending us stuff; I will keep going to the floor. 

Mr. Bagdoyan. So in terms of where CMS is with the controls, 
what we call the control environment, which is a series of controls 
designed to verify information, identify potential indicators of 
fraud, and so forth, as our undercover work indicated, both for 
2014 and 2015, where we were equally successful, there is a sem- 
blance of controls in place. 

Senator Coats. A semblance? 

Mr. Bagdoyan. A semblance of controls in place, some basic 
things in place, like identity-proofing the document reconciliation 
process to clear inconsistencies, for example. But in each case, we 
were able to work around those reasonably easily and obtain cov- 
erage both for 2014 and 2015. So the vulnerabilities are still in 
place. 
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Now, with the recommendations we made in this report, actually, 
in late February, we made eight recommendations. As I explained 
to Senator Stabenow, the big one is to perform a comprehensive 
risk assessment. 

Now, that is going to take time. It is going to take time for CMS 
to absorb the results and then craft, hopefully, appropriate solu- 
tions for the future. So this is a long-term proposition. It is not 
going to be an easy fix. 

Senator Coats. Well, I think this speaks to the point that we got 
a bad start and everything is going great right now. Everything is 
not going great right now. As you said, this is going to take a long- 
term effort to try to put these verification procedures in place and 
to be able to say that we are successfully avoiding fraud and waste 
and an inefficiency and taxpayer cost level that is just absolutely 
astounding. 

So, with due respect to my colleagues, to tout this as something 
that has happened in the past but is corrected now and we are sail- 
ing into the bright future, I think we have a lot of work to do. 

Thanks, Mr. Chairman. 

The Chairman. Senator Wyden? 

Senator Wyden. Thank you, Mr. Chairman. 

I want to again say that the initial rollout was botched, and I 
appreciated the Inspector General making it clear that a couple 
months in, there was serious progress. 

So you all reported that after the first open enrollment, the agen- 
cy demonstrated a strong sense of urgency to take action, accepted 
new work processes, and they, quote, “improved the HealthCare.gov 
website substantially within 2 months.” 

I think it would be helpful, Ms. Bliss, if you could tell us two 
things. What were the operational and strategic changes that were 
made after that first open enrollment, and do you feel they are 
better-equipped to deal with the challenge now? 

Ms. Bliss. Thank you. Ranking Member Wyden, for that ques- 
tion. As we discussed in the case study, some of the key strategic 
and operational changes that were made as part of the correction 
were to, one, establish more clear leadership and designate roles 
and responsibilities, and they did it in a way that really brought 
together staff and contractors across all of the important business 
lines that were affected and needed to be involved in the correction. 
That includes the policy people, the technical, the communications, 
and the contractors all coming together. 

With the influx of experts from across government and the pri- 
vate sector, there was the potential that it could have become more 
chaotic, but, in fact, we saw that the reverse was true. It was well- 
organized. Folks were working together in a badgeless culture as 
a team. There was better communication, there was better meas- 
urement and monitoring of problems, and there was progress in 
order to apply solutions more quickly and effectively. 

Senator Wyden. So, in effect, after the first few months, which 
everybody has acknowledged were not ideal, your characterization 
was that essentially it was well-organized. 

Ms. Bliss. It was much better organized 

Senator Wyden. I was using your word 

Ms. Bliss [continuing]. And they continue to make progress. 
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Senator Wyden. All right. Good. Mr. Bagdoyan, first, I am prob- 
ably the biggest user of GAO products here in the Congress. I so 
admire the professionalism of the agency, and I think you heard 
me say I do not take a back seat to anybody when it comes to 
cracking down on actual real-world fraud. 

My question to you is, is it not correct that when you testified 
before the committee last year, you stated that the secret shopper 
investigation failed to uncover a single real-world example of 
fraud? 

Mr. Bagdoyan. Yes, that is what I said. Senator Wyden, and I 
would also couch that very carefully for you and the committee. 

The intent of that investigation was not to uncover fraud but to 
flag control vulnerabilities, as well as identify indicators of poten- 
tial fraud, which I think we did quite successfully. 

So I just want to make clear my charge is not to find fraud. 
Fraud is determined through a separate criminal proceeding in 
courts to definitively determine that. So my job, again, is to look 
for vulnerabilities in controls, as well as identify indicators of po- 
tential fraud or improper payments. 

Senator Wyden. So let us go then from last year when there was 
not one single real-world example of fraud to where we are now. 
Is it correct to say that the entire investigation failed to identify 
any actual fraud? 

Mr. Bagdoyan. Well, again, I would refer you to my answer. 
That was not our intent. So if I am not looking for fraud, I am not 
going to find it. What I am looking for is vulnerabilities in controls 
and indicators of potential fraud, such as the inconsistencies with 
the Social Security numbers, as well as, in the case of the IRS, 1.3 
million people having potential ID theft issues, which is a signifi- 
cant red flag. 

Senator Wyden. I think that, as is always the case, you all are 
right to talk about various issues that ought to be part of the de- 
bate. That is not what is going on here. What people are saying is, 
this is fraud, fraud, fraud, fraud, and I appreciate your taking us 
through this in, I think, a better-balanced view. 

Ms. Bliss, at HHS, you all do audits, GIG does audits. Have you 
uncovered, in connection with this, any confirmed cases of fraud? 

Ms. Bliss. No, we have not had any cases that have resulted in 
criminal convictions or civil settlements to date. We do have a few 
investigations that are ongoing, and I cannot predict what those 
outcomes will be. 

Senator Wyden. Look, I do not know how many times I have 
said in this committee that when there are big, important issues — 
and certainly the Affordable Care Act is right at the top — we need 
to work in a bipartisan fashion, and there is not a program any- 
where in government where you cannot find opportunities to work 
together and be bipartisan. 

I ticked off a number of them. The chairman and I are working 
together on what I think is the future of the Medicare program, 
chronic care; Senator Grassley and I are finishing what I think is 
a blockbuster study looking at hepatitis C. And it raises the ques- 
tion of, when we have cures, will people be able to afford them? 

What I think is important is that, to do bipartisan work, we have 
to move away from, first, the past, because everybody has acknowl- 
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edged that the first few months were botched. I do not know how 
many times you can say it. But you all said — and I read your com- 
ments — after the first few months, you said they had made sub- 
stantial improvements. I think I can come back to it and perhaps 
read it one more time. 

“The Centers for Medicare and Medicaid Services recovered the 
health care government website for high consumer use within 2 
months.” Now, that is the new news. That is just a few weeks old. 
That is new news, and I want people to hear that, and I want peo- 
ple to hear that there were no actual real-world cases of fraud un- 
covered. 

Now, one final question, if I might, for you, Ms. Bliss. Do you dis- 
agree with the statement that I made with respect to the accom- 
plishments of the Affordable Care Act? That is not your formal role 
as Inspector General, but does anything strike you as being inac- 
curate there with respect to the uninsured rate or anything of that 
nature? 

Ms. Bliss. As an independent oversight agency, we do not take 
positions on whether particular programs should exist, but we look 
to make sure they are operating correctly. 

Senator Wyden. That is not the question. The question was 
about the facts, and what I think, again, is, this is a hard fact that 
is not in dispute, that the uninsured rate is now at or near the low- 
est level recorded across 5 decades of data, with about 20 million 
previously uninsured Americans gaining coverage since the Act’s 
provisions went into effect. 

So I will keep the record open so that if you or your agency has 
any information suggesting that is wrong, I would surely like to 
know about it. 

Ms. Bliss. Thank you. I do not have any information suggesting 
that that is wrong. 

Senator Wyden. Wonderful. Mr. Chairman, thank you. 

The Chairman. Senator Scott? 

Senator Scott. Ms. Bliss, do you have any information sug- 
gesting that those numbers are right? 

Ms. Bliss. I cannot validate those numbers. I do not have any 
reason to believe they are not. 

Senator Scott. But you have no indication either way, actually. 

Ms. Bliss. I have no basis, no. 

Senator Scott. If I tell you that the number is 30 million, you 
have no reason to believe that it is not 30 million. 

Ms. Bliss. I do not have a basis for validating that number. Our 
case study — I am sorry. 

Senator Scott. Thank you. Mr. Bagdoyan, our ranking member 
asked you several questions about fraud, and I certainly under- 
stand and appreciate why so many Americans look at this process 
and become disenchanted. 

Your objective was never to figure out how much fraud was in 
the system. Your objective, it appeared to me, was to show us how 
fraud could happen. 

Mr. Bagdoyan. Yes, essentially. Senator, you are correct. The big 
picture we are looking at is for any vulnerabilities in the controls 
that are in place and also for any indicators of potential fraud that 
pop up. For example, our ability to circumvent the controls we en- 
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countered during our undercover work — we did that for 2014, and 
we repeated that experience in 2015, in which case we were suc- 
cessful 17 out of 18 attempts. 

Now, I would have to caution that, of course, further to the point 
that Senator Coats made earlier, that is not a projectable number. 
So we have to be very careful that that does not represent the ac- 
tual universe; that is just a data set that we use to continue our 
work in this area. 

Senator Scott. Thank you very much. No one is going to mistake 
me for a fan of Obamacare or the ACA, without any question. For 
a number of reasons, I am not a fan of the website nor the actual 
policy itself, the legislation. 

I think of the Independent Payment Advisory Board, what some 
have referred to as a death panel, and the ability to ration care 
into the future. This is one of the classic examples of why so few 
Americans have the same appreciation of the ACA that others have 
talked about. 

I think the fact that we are talking about taxing Americans, 
whether it is their income or their profits, an additional 3.8-percent 
tax, raising somewhere over $120 billion, is another reason why so 
few Americans have the same positive theme that we have heard 
from some of our friends on the other side. 

Think about the whole notion of how the health-care law is going 
to regulate the posting of calories at pizza parlors, grocery stores, 
all over the place, and, by default, increase the price of these gro- 
ceries, these pizzas and other non-food items, reducing the number 
of employees’ hours, talking about the impact on middle-income 
America, so many Americans losing perhaps up to 25 percent of 
their income because of the ACA. 

We can see why so many Americans have found frustration with 
where we are with the ACA, that it is not old news to them. 

It is not old news, actually, when you think about the fact that 
so many Americans are facing higher premiums. We have heard so 
many different numbers this morning. We know that at least some 
States have seen an increase of more than 25 percent in their 
health-care costs. Two States have seen those numbers go over 35 
percent. Those are real dollars for struggling Americans who can- 
not afford the cost of health insurance. 

Not only are the premiums higher, the deductibles are higher, 
the out-of-pocket expenses are higher. The only thing that is actu- 
ally lower are the doctors to choose from and the hospitals to go 
to. 

We have seen a catastrophic occurrence under this health-care 
law. And even at one of the most recent Democratic town halls, a 
young lady, supportive of President Obama, who supports the 
health-care law, said that her premiums had doubled, tripled. Her 
concerns were strong, clear. 

Here is one real case example that, Ms. Bliss, I hope is no longer 
happening. A young man named Tom Dougall from Elgin, SC, who 
created an account on HealthCare.gov, was called shortly thereafter 
by a man named Mr. Justin Hadley from North Carolina who had 
done the exact same thing: gone online to HealthCare.gov and cre- 
ated an account. But what he found populating his account was in- 
formation from Mr. Dougall. 
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He called HHS and could not get any assistance. Finally, they 
called our office, and, during one of the hearings, we were ahle to 
get that situation solved, or at least the beginning of that situation 
solved. 

Can you guarantee me that that situation is no longer occurring 
anywhere within HealthCare.gov? 

Ms. Bliss. I cannot guarantee that. We have overseen and con- 
ducted reviews of the controls to ensure that the website and other 
parts of the program for identity verification, no eligibility verificat- 
ion, are working properly. But we have raised concerns about some 
flaws or weaknesses in those controls, similar to GAO, and I cannot 
make that guarantee. But we are certainly working hard to identify 
where there is a vulnerability of that happening and make rec- 
ommendations on how to improve it. 

Senator Scott. My last statement, since I am out of time so 
quickly here today, is, it appears that as we have celebrated the 
success of improving the system in the first couple months — I will 
note it was a new $ 1-trillion program — one of the recommendations 
is for clear leadership. Earth-shattering. Thank you. 

The Chairman. Senator Isakson? 

Senator Isakson. Thank you, Mr. Chairman. 

I apologize for missing your testimony, and I apologize for being 
late. But I do have one question based on a letter that I have sent 
previously to CMS, and I want to ask this question. 

Mr. Bagdoyan, do you agree that increasing the utilization of ex- 
isting, tested data sources is one easy way that CMS could reach 
the mutual goal of expanding program integrity and management 
and better assess fraud risk? 

Mr. Bagdoyan. Yes. That is, in fact, one of our recommendations 
to CMS: to consider doing that on an active basis, both to capture 
the data and then analyze the data for whatever indicators that 
they may throw off and act upon those. Yes. 

Senator Isakson. Then do you have any idea when CMS is going 
to move forward to actually take advantage of that and do it? 

Mr. Bagdoyan. Well, as I stated before in response to several 
Senators’ questions, CMS has accepted those recommendations. 
They are on record in writing as having done so. And as I said in 
my opening statement, it is now incumbent on the agency to take 
action on a timely basis. But as I said, it will take time to work 
through this. It is not an easy fix. It is not a short-term fix. It is 
not a one-and-done fix. 

Senator Isakson. Well, I apologize for being late, because obvi- 
ously you covered it in your opening statement. But there is readily 
available data and companies that are already under contract to 
CMS that are available to provide information that could greatly 
enhance the integrity of the program and uproot fraud a lot easier, 
and I appreciate your testimony to that effect. 

Mr. Bagdoyan. Yes. The data are available, definitely. 

Senator Isakson. Thank you. Thank you, Mr. Chairman. 

The Chairman. Thank you. I want to thank our witnesses for ap- 
pearing here today. The work that each of you does is very impor- 
tant, as far as we are concerned, you and your organizations. It is 
vitally important to this committee, and we are thankful for the 
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quality product that both the HHS/OIG and GAO produce to assist 
us in our policymaking and oversight efforts. 

I also want to thank my colleagues for their participation in this 
important hearing. I think the hearing has been insightful. It has 
been enlightening. Unfortunately, I think this hearing further re- 
vealed that we are only now getting to the water level of the 
Obamacare iceberg, it seems to me. 

As premiums continue to skyrocket and insurance options be- 
come more and more limited, an increasing number of Americans 
are being hung out to dry. Over the past year, we had a reasonable 
amount of consensus on several of the unworkable and failed provi- 
sions of Obamacare, but for some reason, many still have their 
heads stuck in the sand hoping that things will finally start work- 
ing out at some point. 

Now, I implore my Democratic colleagues to work with me and 
my Republican friends to repeal and replace the so-called Afford- 
able Care Act before it is altogether too late. Insurance premiums 
and health-care costs continue to rise, and little is being done to 
stem the tide. 

It is high time to put partisan politicking and bickering aside 
and find workable bipartisan solutions. There is more we can do. 
There is more we, it seems to me, have to do. Honestly, I earnestly 
believe that we can do it. The American people deserve better than 
what they have right now and, more importantly, than what they 
are about to have in the next few years. 

So I encourage each of my colleagues to meet with me and find 
workable solutions, and I encourage both of you to keep doing the 
jobs that you are doing. They are very important to this committee 
and I think to our country at-large. 

I would ask that any written questions for the record be sub- 
mitted by Thursday, March 31st of this year. 

With that, this hearing will be adjourned. Thank you for being 
here. 

[Whereupon, at 11:10 a.m., the hearing was concluded.] 
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Prepared Statement of Seto J. Bagdoyan, Director of Audits, Forensic 
Audits and Investigative Service, Government Accountability Office 

Chairman Hatch, Ranking Member Wyden, and members of the committee: 

I am pleased to be here today to discuss enrollment and verification controls for 
health-care coverage that individuals obtain through the Federal health-insurance 
exchange under the Patient Protection and Affordable Care Act (PPACA). The act 
expands the availability of subsidized health-care coverage, and it provides for the 
establishment of health-insurance exchanges, or marketplaces, to help consumers in 
comparing and selecting among insurance plans offered by participating private 
issuers of health-care coverage. Under PPACA, States may elect to operate their 
own health-care marketplaces, or may rely on the federally facilitated marketplace, 
or Health Insurance Marketplace (Marketplace). ^ The Centers for Medicare and 
Medicaid Services (CMS), a unit of the Department of Health and Human Services 
(HHS), maintains the Federal Marketplace. 

To be eligible to enroll in a qualified health plan offered through a marketplace, 
an individual must be a U.S. citizen or national, or otherwise lawfully present in 
the United States; reside in the marketplace service area; and not be incarcerated 
(unless incarcerated while awaiting disposition of charges). Marketplaces, in turn, 
are required by law to verify application information to determine eligibility for en- 
rollment and, if applicable, determine eligibility for income-based subsidies the act 
provides. 

PPACA provides subsidies to those eligible to purchase private health-insurance 
plans who meet certain income and other requirements. According to the Congres- 
sional Budget Office, the estimated cost of subsidies and related spending under the 
act is $880 billion for fiscal years 2016-2025. While subsidies under the act are not 
paid directly to enrollees, participants nevertheless benefit through reduced monthly 
premiums or lower costs due at time of service, such as copayments.^ Because sub- 
sidy costs hinge on eligibility for coverage, enrollment controls that help ensure only 
qualified applicants are approved for coverage with subsidies are a key factor in de- 
termining Federal expenditures under the act. 

A central feature of the enrollment controls is the Federal “data services hub” 
(data hub), which, among other things, provides a vehicle to check applicant-pro- 
vided information against a variety of data sources.® Verification steps include vali- 


1 Specifically, the act required, by January 1, 2014, the establishment of health-insurance 
marketplaces in ah States. In States not electing to operate their own marketplaces, the Federal 
Government was required to operate a marketplace. 

2 Enrollees can pay lower monthly premiums by virtue of a tax credit the act provides. 

® In particular, PPACA requires that consumer-submitted information be verified, and that de- 
terminations of eligibility be made, through either an electronic verification system or another 
method approved by HHS. To implement this verification process, CMS developed the data hub, 
which acts as a portal for exchanging information between the Federal Marketplace, State-based 
marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, in- 
cluding other Federal agencies. The Marketplace uses the data hub in an attempt to verify that 
applicant information necessary to support an eligibility determination is consistent with exter- 
nal data sources. 


( 21 ) 
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dating an applicant’s Social Security number, if one is provided; ^ verifying citizen- 
ship, status as a national, or lawful presence by comparison with Social Security Ad- 
ministration (SSA) or Department of Homeland Security (DHS) records; and ver- 
ifying household income and family size by comparison against tax-return data from 
the Internal Revenue Service (IRS), as well as data on Social Security benefits from 
SSA. 

If the eligibility information applicants provide to the Federal Marketplace cannot 
be verified through the external sources, such as SSA, IRS, and DHS, an “inconsist- 
ency” will result. In particular, an inconsistency can arise when the data hub query 
process yields no information; or when information is available through the data 
hub, but it does not match information the applicant has provided.^ 

My testimony today is based on a report we issued on February 23, 2016, that 
examined eligibility and enrollment controls, and fraud risk, of the Federal Market- 
place.® It addresses: 

1. The extent to which applicant information is verified through the data hub — 
the primary means for verifying eligibility; and 

2. The extent to which the Federal Marketplace resolved inconsistencies that re- 
sulted from the data hub verification process."^ 

In our report, to examine outcomes of the data hub applicant verification process, 
we obtained summary data from key Federal agencies involved in the process — SSA, 
IRS, and DHS — on the nature and extent of their responses to electronic inquiries 
made through the data hub, for the 2014 and 2015 coverage years.® We also inter- 
viewed agency officials and reviewed statutes, regulations, and other policy and re- 
lated information. In addition, we obtained applicant data on inconsistencies, sub- 
sidies awarded, and submission of required verification documentation, from CMS 
data systems for coverage year 2014. To determine the reliability of data we used, 
we interviewed CMS officials and others responsible for their respective data, re- 
viewed relevant documentation, and performed electronic testing to determine the 
validity of specific data elements we used to perform our work. Based on this reli- 
ability examination, we concluded that the data we used were sufficiently reliable 
for our purposes. 


marketplace must require an applicant who has a Social Security number to provide the 
number. 42 tJ.S.C. § 18081(b)(2) and 45 CFR § 155.310(a)(3)(i). However, having a Social Secu- 
rity number is not a condition of eligibility. 

®When an inconsistency is generated, the Marketplace is to proceed with determining other 
elements of eligibility using the attestations of the applicant, and ensure that subsidies are pro- 
vided on behalf of the applicant, if he or she is qualified to receive them, while the inconsistency 
is being resolved. As part of this resolution process, the applicant is generally required to submit 
documentation to substantiate eligibility for the program. In the case of the Federal Market- 
place, CMS uses a document-processing contractor, which reviews documentation applicants 
submit, by mail or online upload, to resolve inconsistencies. Inconsistencies are discussed more 
fully later in this testimony. 

® GAO, Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment 
Controls and Manage Fraud Risk, GAO-16—29 (Washin^on, DC: February 23, 2016). In addi- 
tion, we have presented two other related testimonies prior to issuance of the report. See GAO, 
Patient Protection and Affordable Care Act: Preliminary Results of Undercover Testing of Enroll- 
ment Controls for Health Care Coverage and Consumer Subsidies Provided Under the Act, GAO— 
14-705T (Washington, DC: July 23, 2014); and GAO, Patient Protection and Affordable Care Act: 
Observations on 18 Undercover Tests of Enrollment Controls for Health-Care Coverage and Con- 
sumer Subsidies Provided under the Act, GAO— 15-702T (Washington, DC: July 16, 2015). 

"^In addition to findings presented in this testimony — and as described in detail in our July 
2015 testimony, with additional information provided in our February 2016 report — our work 
also identified vulnerability to fraud, when we obtained, through covert vulnerability testing. 
Federal Marketplace approval of subsidized coverage for 11 of 12 fictitious applicants for 2014, 
with coverage continuing into 2015. We concluded CMS has assumed a passive approach to 
identifying and preventing fraud, and that adopting a more strategic, risk-based approach could 
help identify fraud vulnerabilities before they could be exploited in the enrollment process. We 
recommended that HHS direct CMS to conduct a fraud risk assessment, consistent with best 
practices provided in GAO’s framework for managing fraud risks in Federal programs, of the 
potential for fraud in the process of applying for qualified health plans through the Federal Mar- 
ketplace. HHS concurred with our recommendation and said it plans to conduct such an assess- 
ment. See the framework at GAO, A Framework for Managing Fraud Risks in Federal Pro- 
grams, GAO-15— 593SP (Washington, DC: July 2015). 

® In this testimony, we use “outcomes” to mean results obtained from inquiries made through 
the data hub, and not any ultimate determination made whether an applicant inconsistency ex- 
ists. 
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Additional details on our scope and methodology can be found in our report. We 
conducted our performance audit from January 2014 to February 2016 in accordance 
with generally accepted government auditing standards. 

CMS’S APPROACH TO APPLICANT VERIFICATION INFORMATION NEEDS IMPROVEMENT 

HHS officials described the data hub process to us as being part of an innovative, 
multilayered approach to verifying applicant information efficiently and without 
undue burden on individuals and families. Through secure electronic connections, 
the data hub provides real-time responses to eligibility queries, HHS told us. 

In our February 2016 report, however, we found that although the data hub plays 
a key role in the eligibility and enrollment process, CMS officials said the agency 
does not track the extent to which the Federal agencies deliver responsive informa- 
tion to a request, or, alternatively, whether they report that information was not 
available. Additionally, CMS officials said they do not analyze data provided in re- 
sponse to data hub inquiries. This is because, they said, by design, the data hub 
does not store individual transactional data that could be collectively analyzed over 
time. For policy reasons, the officials said, the agency did not want the data hub 
to become a data repository itself, and in particular, a repository of sensitive per- 
sonal data.® The CMS officials also said the agency is barred legally from maintain- 
ing IRS taxpayer information in the data hub. 

Asked about analysis of data hub responses, CMS officials told us when we con- 
ducted work for our February 2016 report that the key performance measures for 
the data hub are the extent to which the system is available for queries, and the 
extent to which transmissions of queries and responses are successfully accom- 
plished; that is, that an inquiry is made and a corresponding reply received, without 
regard to content. 

Further, the Federal agencies responding to data hub queries generally told us 
they do not analyze outcomes of data hub inquiries. Instead, SSA, IRS, and DHS 
officials said they focus on responding to inquiries received. Our review also found 
that SSA, IRS, and DHS had limited information on the nature and extent of the 
inquiries made by the data hub. According to the three agencies, available statistics 
reflect data hub inquiries in general, and cannot be broken out by program, such 
as a qualified health plan or Medicaid. In addition, according to agency officials, an 
unknown number of data hub applicant inquiries were duplicates, which we could 
not eliminate from our examination.^! Instead, agency officials told us, they gen- 
erally process inquiries sequentially as they are received from the data hub. Thus, 
we found that while the agencies can provide some information on data hub queries, 
they cannot provide comprehensive information specifically on number of inquiries 
and individuals represented by those queries. 

We further found, based on our examination of available statistics from SSA, IRS, 
and DHS, that while the agencies could successfully provide applicant verification 
information in a large percentage of cases, they did not have data in their records 
to verify information for millions of data hub inquiries over the course of PPACA’s 
first two enrollment cycles, for 2014 and 2015 coverage.!^ 

We concluded that by not assessing the extent to which data hub — provided data 
matches applicant-provided information, CMS foregoes analysis of the extent to 
which responding agencies successfully deliver applicant verification information in 


®In particular, according to CMS officials, the data hub does not read and store the content 
of requests received. It only validates message structure and determines routing information to 
send the request to the correct destination. The data hub next returns the response it receives 
to the requester. The data hub stores data such as transaction identifier for each request. By 
CMS requirements, the data hub cannot store privacy data, the officials said. 

According to CMS officials, the data hub only captures a code for type of reply that is gen- 
erated when agencies respond to the inquiries, and those codes are not associated with any 
other applicant-identifying information or information that may have been provided in response 
to the query. There are no additional data kept on what information might have been trans- 
mitted in the source agency’s response, such as income or family size. Likewise, the data hub 
does not track whether information provided through the data hub matches information origi- 
nally provided by the applicant, the officials said. 

!! The agencies could not comprehensively identify the number of duplicates. 

For example, SSA accomplished a match on name. Social Security number, and date of birth 
in about 95 percent of cases for PPACA’s first enrollment cycle, for 2014 coverage. However, for 
about 4.4 million inquiries — or about 5 percent of the total — the applicant information did not 
match SSA records. In addition, after completion of the name. Social Security number, and date 
of birth match, when SSA attempted to verify additional information, the agency could not con- 
firm citizenship in about 8.2 million inquiries where individuals claimed they were citizens. 
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response to data hub requests. In doing so, CMS foregoes information that could 
suggest potential program issues or potential vulnerabilities to fraud, as well as in- 
formation that might be useful for enhancing program management. We rec- 
ommended that HHS direct CMS to conduct a comprehensive feasibility study on 
actions CMS can take to monitor and analyze, both quantitatively and qualitatively, 
the extent to which data hub queries provide requested or relevant applicant 
verification information, for the purpose of improving the data-matching process and 
reducing the number of applicant inconsistencies; and for those actions identified as 
feasible, create a written plan and schedule for implementing them. HHS said it 
concurred with our recommendation and is reviewing options for such a study. 

THE FEDERAL MARKETPLACE DID NOT RESOLVE ABOUT ONE-THIRD OF APPLICANT IN- 
CONSISTENCIES FOR COVERAGE YEAR 2014, INVOLVING $1.7 BILLION IN ASSOCIATED 

SUBSIDIES 

For qualifying applicants, the act provides two forms of subsidies for consumers 
enrolling in individual health plans, both of which are paid directly to insurers on 
consumers’ behalf. One is a Federal income tax credit, which enrollees may elect to 
receive in advance of filing tax returns, and which reduces a consumer’s monthly 
premium payment. This is known as the advance premium tax credit (APTC).^^ The 
other, known as cost-sharing reduction (CSR), is a discount that lowers the amount 
consumers pay for out-of-pocket charges such as deductibles, coinsurance, and co- 
payments. 

In our report, for applicants who obtained subsidies but had application inconsist- 
encies, we identified about 1.1 million applications with a total of about 2 million 
inconsistencies.^® These applications had combined APTC and CSR subsidies of 
about $4.4 billion associated with them for coverage year 2014. We found, based on 
our analysis of CMS data, that the agency resolved about 58 percent of the total 
inconsistencies, meaning the inconsistencies were settled by consumer action, such 
as document submission, or removed due to events such as life change, application 
deletion, or consumer cancellation. Meanwhile, our analysis found that about 34 
percent of inconsistencies, with about $1.7 billion in associated subsidies, remained 
open, as of April 2015 — that is, inconsistencies still open several months following 
the close of the 2014 coverage year.^® 


i^By analyzing the outcomes of data hub inquiries, and in particular, clarifying the nature 
and extent of inconsistencies arising from this process, CMS could, for example, assess whether 
other sources of data, such as the National Directory of New Hires, could be useful for more 
current applicant information on income. Similarly, CMS could analyze the information to exam- 
ine whether other sources of citizenship information, such as the Department of State’s passport 
data, could be used to aid in verifying applicant citizenship. There may also be correlations ob- 
served between various types of applicants and types of information available from trusted data 
sources. 

^^When applicants apply for coverage, they report family size and the amount of projected 
income. Based, in part, on that information, the Marketplace will calculate the maximum allow- 
able amount of APTC. An applicant can then decide if he or she wants all, some, or none of 
the estimated credit paid in advance, in the form of payment to the applicant’s insurer that re- 
duces the applicant’s monthly premium payment. If an applicant chooses to have all or some 
of his or her credit paid in advance, the applicant is required to “reconcile” on his or her Federal 
tax return the amount of advance payments the government sent to the applicant’s insurer on 
the applicant’s behalf with the tax credit for which the applicant qualifies based on actual re- 
ported income and family size. 

i®In particular, we obtained data from CMS on applicant inconsistencies generated for the 
Federal Marketplace and the value of APTC and CSR subsidies associated with them, for the 
2014 coverage year. Specifically, to observe the number of inconsistencies created and subse- 
quently resolved, we examined applications that were awarded subsidies and that were created 
and submitted during the 2014 open-enrollment period plus a special enrollment period exten- 
sion that followed. The open-enrollment period ran from October 1, 2013, to March 31, 2014, 
and the extension was through April 19, 2014. 

We excluded from our analysis applications modified after submission, because CMS officials 
told us that inconsistencies can be generated or resolved based on consumer actions, such as 
updating of application information. We selected the unmodified applications that had received 
subsidies as presenting the simplest case for examining inconsistency generation and subse- 
quent resolution. 

Our selection criteria meant excluding 17 percent of the total number of applications with sub- 
sidies and inconsistencies because they had been modified. A single application may reflect more 
than one person, each of whom might have different inconsistencies in different stages of resolu- 
tion. The CMS data provided the APTC and CSR amounts at the application level. Con- 
sequently, the results of our analysis are not mutually exclusive by t3q)e of inconsistency, and 
applications and their associated subsidy amounts may be represented in multiple categories. 

i®The remainder were terminations or adjustments based on failure to submit documentation 
to resolve inconsistencies. By comparison with the inconsistency results in our analysis, HHS 
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We also found, based on our analysis of the 2014 data, that CMS did not termi- 
nate or adjust subsides for any applications with incarceration or Social Security 
number inconsistencies, plus other inconsistencies.^^ Further, CMS officials told us 
that they currently do not plan to take any actions on individuals with unresolved 
Social Security number or incarceration inconsistencies. 

Social Security number ineonsisteneies. Under CMS regulations, the Market- 
place must validate all Social Security numbers provided by submitting them to 
SSA along with other identifying information. If the Marketplace is unable to vali- 
date the Social Security number, it must follow the standard process for resolving 
all types of inconsistencies. In our analysis, we identified about 35,000 applica- 
tions that had an unresolved Social Security number inconsistency, which were as- 
sociated with about $154 million in combined subsidies. 

We reported that CMS officials told us they did not take action to terminate cov- 
erage or adjust subsidies during 2014 based on Social Security number inconsist- 
encies. They said this was because such inconsistencies are generally related to 
other inconsistencies, such as citizenship or immigration status, and that document 
submissions for citizenship or immigration status may also resolve Social Security 
number inconsistencies. Overall, CMS officials told us they do not consider missing 
or invalid Social Security number information to be a stand-alone inconsistency that 
must be resolved, and do not take adverse action in such cases. 

However, CMS regulations state that “to the extent that the [Marketplace] is un- 
able to validate an individual’s Social Security number through the Social Security 
Administration,” the Marketplace must follow its standard inconsistency proce- 
dures.'^® Further, when promulgating this regulation, CMS explained that transmit- 
ting Social Security numbers to SSA for validation “is separate from the [PPACA] 
provision regarding citizenship verification, and only serves to ensure that SSNs 
[Social Security numbers] provided to the [Marketplace] can be used for subsequent 
transactions, including for verification of family size and household income with 
IRS.” 2® 

In addition to unresolved Social Security number inconsistencies generally, our 
analysis also found in particular more than 2,000 applications with Social Security 
number inconsistencies that had no corresponding citizenship or immigration incon- 
sistencies. We also identified nearly 5,500 applications with Social Security number 
inconsistencies that had no corresponding income inconsistency. These applications 
had total subsidies of about $10 million and $31 million associated with them, re- 
spectively. They indicate that Social Security number inconsistencies can stand 
alone, unrelated to other inconsistencies. 

Social Security number inconsistencies also affect teix compliance. Missing or in- 
valid Social Security numbers can affect IRS verification that taxpayers have prop- 
erly filed APTC information on their tax returns, as well as impair IRS outreach 
to taxpayers who have received the APTC subsidy.^' 

We recommended that HHS direct CMS to identify and implement procedures to 
resolve Social Security number inconsistencies where the Marketplace is unable to 
verify Social Security numbers or applicants do not provide them. HHS concurred 
with our recommendation, but did not provide details on how it would seek to imple- 
ment it. 

Incarceration inconsistencies. In our inconsistency analysis that we reported 
on in February 2016, we identified about 22,000 applications having an unresolved 
incarceration inconsistency, which were associated with about $68 million in com- 
bined subsidies. CMS officials, however, told us they did not terminate eligibility for 
incarceration inconsistencies, because the agency determined in fall 2014 that SSA’s 
Prisoner Update Processing System (PUPS) was unreliable for use by the Market- 


reported that more than 8.84 million people selected or were automatically reenrolled in 2015 
plans through the Federal Marketplace as of the end of the second open enrollment period on 
February 15, 2015. 

''’These other inconsistencies relate to American Indian status, and presence of qualifying 
employer-sponsored coverage or other minimum essential coverage. 

18 45 CFR § 155.315(b). 

i®45 CFR § 155.315(b). 

2077 Fed. Reg. 18310, 18355 (March 27, 2012). 

21 See GAO-16—29 for a full discussion. 
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place.^^ As a result, CMS officials told us the agency elected to rely on applicant 
attestations on incarceration status.^^ 

PPACA provides that incarcerated individuals are not eligible to enroll in a quali- 
fied health plan through a marketplace, with the exception of those incarcerated 
pending disposition of charges. CMS currently uses PUPS to generate incarceration 
inconsistencies when there are indications an applicant may be incarcerated. As 
part of the inconsistency resolution process, the Marketplace notifies applicants to 
send documentation to resolve the inconsistency. To do so, consumers can submit 
documentation such as release papers, CMS officials told us. 

Under CMS’s approach to incarceration inconsistencies, agency officials told us, 
the Marketplace continues to make an initial verification attempt using the PUPS 
data. If a consumer maintains he or she is not incarcerated, CMS will rely on that 
representation and not take adverse action, regardless of what PUPS indicates, offi- 
cials told us. According to HHS officials, based on the data reliability issue, the 
Marketplace no longer requires applicants to submit documentation on incarceration 
status. 

In its 2013 computer-matching agreement with CMS, SSA acknowledged that 
PUPS is not as accurate as other SSA data and contains information that SSA may 
not have independently verified. Thus, the agreement states that CMS will inde- 
pendently verify information it receives from PUPS and will provide individuals an 
opportunity to contest an incarceration inconsistency before any adverse action in 
an eligibility determination. Overall, according to SSA officials, PUPS information 
can be used to identify individuals who require additional follow-up to determine eli- 
gibility. 

We reported that our review of documentation CMS provided for its decision to 
take no adverse action on incarceration inconsistencies showed it did not contain 
key information supporting the agency’s decision to not use PUPS data. Specifically, 
the documentation did not provide specific details on why, or to what extent, people 
were misidentified as incarcerated; why CMS also judged inmate release informa- 
tion to be unreliable; any criteria or assessment employed to conclude that the 
PUPS data were not sufficiently current or accurate; or the potential cost associated 
with not verif3dng incarceration status. 

We concluded that without clearly identifying such elements as analysis, scope, 
and costs of significant decisions, CMS is at greater risk of providing benefits to in- 
eligible applicants, and also may undermine confidence in the applicant verification 
process and compromise overall program integrity. We further concluded that by not 
using PUPS data as a lead for further investigation, and by relying on applicant 
attestation in the alternative, CMS may be granting eligibility to, and making sub- 
sidy pajunents on behalf of, individuals who are ineligible to enroll in qualified 
health plans. 

We recommended that HHS direct CMS to reevaluate use of PUPS incarceration 
data and make a determination to either (1) use the PUPS data, among other 
things, as an indicator of further research required in individual cases, and to de- 
velop an effective process to clear incarceration inconsistencies or terminate cov- 
erage; or (2) if no suitable process can be identified to verify incarceration status, 
accept applicant attestation on status in all cases, unless the attestation is not rea- 
sonably compatible with other information that may indicate incarceration, and 
forego the inconsistency process. HHS concurred with our recommendation, but did 
not provide details on how it would seek to implement it. 

We also recommended that HHS direct CMS to fully document prior to implemen- 
tation, and have readily available for inspection thereafter, any significant decision 
on qualified health plan enrollment and eligibility matters, with such documenta- 
tion to include details such as policy objectives, supporting analysis, scope, and ex- 


22 The PUPS system contains information on incarcerated individuals in all 50 State correc- 
tions departments, the Federal Bureau of Prisons, and local and other facilities. According to 
SSA, it is the only national database with records of Federal, State, and local incarcerations. 
SSA uses PUPS to identify individuals who may no longer be eligible for SSA benefits due to 
incarceration. In addition to SSA, other Federal programs, such as Medicare, use PUPS data. 

22 In the absence of an approved data source, the Marketplace may accept applicant attesta- 
tion on incarceration status without further verification, unless the attestation is not reasonably 
compatible with other information in its records. 45 CFR § 155.315fe). 
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pected costs and effects. HHS concurred with our recommendation, and said it was 
committed to documenting significant decisions.^'' 

Chairman Hatch, Ranking Member Wyden, and members of the committee, this 
completes my prepared statement. I would be pleased to respond to any questions 
that you may have at this time. 


Questions Submitted for the Record to Seto J. Bagdoyan 
Questions Submitted by Hon. Chuck Grassley 

I would like the record to show that I was unable to attend this hearing in person. 
As Chairman of the Senate Judiciary Committee, I was overseeing the debate about 
the Supreme Court vacancy. The two hearings were at the same time. 

It was pretty disturbing to hear the report of your undercover testing of the Fed- 
eral Marketplace last year. 

Eleven of 12 — that’s over 90% — of fictitious GAO phone or online applicants were 
able to obtain a total of $30,000 in Obamacare subsidies and were able to maintain 
coverage throughout 2014. People signed up and received subsidies and coverage in 
some cases without any documentation. 

And as shocking as that is, today’s report is even worse. You reveal vulnerabilities 
at the data hub of HealthCare.gov that could cost taxpayers billions of dollars. 

Question. Your report found that CMS does not track the responses to inquiries 
made of Federal agencies at the data hub. If CMS does not track or analyze this 
information, how can eligibility for Obamacare and subsidies be verified, as required 
by law? 

Answer. In accordance with our audit objectives, our work focused on macro- 
analysis of data hub query outcomes, and did not address the process of making eli- 
gibility determinations for individual applications. 

Thus, in our February 2016 report, we found that although the data hub plays 
a key role in the eligibility and enrollment process. Centers for Medicare and Med- 
icaid Services (CMS) officials said the agency does not track the extent to which the 
Federal agencies deliver responsive information to a request, or, alternatively, 
whether they report that information was not available. Additionally, CMS officials 
said they do not analyze data provided in response to data hub inquiries. ^ 

By analyzing the outcomes of data hub inquiries and, in particular, clarifying the 
nature and extent of inconsistencies arising from this process, CMS could, for exam- 
ple, assess whether other sources of data could be useful to provide more current 
information on applicant income.^ There may also be correlations observed between 
various types of applicants and types of information available from data sources. 

We concluded that by not assessing the extent to which data provided through 
the data hub matches applicant-provided information, CMS foregoes analysis of the 
extent to which responding agencies successfully deliver applicant verification infor- 
mation in response to data hub requests. Without such an analysis, CMS foregoes 
information that could suggest potential program issues or potential vulnerabilities 
to fraud, as well as information that might be useful for enhancing program man- 
agement. 


24 In all, our February 2016 report contained eight recommendations to HHS, and the agency 
concurred with all of them. See GAO— 16-29 for the complete list of recommendations, as well 
as HHS agency comments and our evaluation of them. 

^See GAO, Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enroll- 
ment Controls and Manage Fraud Risk, GAO— 16— 29 (Washington, DC: February 23, 2016). A 
central feature of enrollment controls under the Patient Protection and Affordable Care Act 
(PPACA) is the Federal “data services hub” (data hub), which, among other things, provides a 
vehicle to check applicant-provided information against a variety of data sources. In particular, 
the act requires that consumer-submitted information be verified, and that determinations of 
eligibility be made, through either an electronic verification system or another method approved 
by the Department of Health and Human Services (HHS). To implement this verification proc- 
ess, CMS developed the data hub, which acts as a portal for exchanging information between 
the Federal Health Insurance Marketplace, State-based marketplaces, and Medicaid agencies, 
among other entities, and CMS’s external partners, including other federal agencies. 

2 An “inconsistency” arises when an applicant’s information does not match information from 
marketplace data sources. 
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Question. Monitoring activities are an important part of fraud prevention. What 
does CMS need to do in order to implement effective monitoring activities? 

Answer. In our February 2016 report, we recommended that CMS should conduct 
a comprehensive feasibility study on actions it can take to monitor and analyze, 
both quantitatively and qualitatively, the extent to which data hub queries provide 
requested or relevant applicant verification information, for the purpose of improv- 
ing the data-matching process and reducing the number of applicant inconsistencies; 
and for those actions identified as feasible, create a written plan and schedule for 
implementing them. The Department of Health and Human Services (HHS), CMS’s 
parent agency, concurred with our recommendation. 

Question. Rather than track the amounts of the subsidies, CMS compiles the num- 
ber of individuals or households affected when a subsidy is terminated for incom- 
plete information. These changes to these subsidies have a cost to taxpayers. Fed- 
eral internal control standards state that managers need financial information to 
make operating decisions, among other activities. How can CMS improve in this 
area in order to be a better steward of the taxpayers’ dollars? 

Answer. In our February 2016 report, we recommended that CMS track the value 
of advance premium tax credit and cost-sharing reduction subsidies that are termi- 
nated or adjusted for failure to resolve application inconsistencies, and use this in- 
formation to inform assessments of program risk and performance.^ HHS concurred 
with our recommendation. 

Question. In your testimony, you explained that GAO had used a “secret shopper” 
technique to explore possible vulnerabilities to fraud within HealthCare.gov. 

Is this technique a well-accepted tool for government and private auditors to use? 

Answer. We have not examined the prevalence of covert testing in other settings, 
but GAO has conducted undercover work, including the use of fictitious applicants, 
to test controls in other Federal programs, in addition to health-care coverage pro- 
vided under the Patient Protection and Affordable Care Act. GAO has received re- 
quests for undercover work from chairs or ranking members of a number of congres- 
sional committees and subcommittees. 

Question. How do you interpret your findings of this particular “secret shopper” 
activity? 

Answer. Through covert vulnerability testing, we obtained Federal Health Insur- 
ance Marketplace (Marketplace) approval of subsidized coverage for 11 of 12 ficti- 
tious applicants for 2014, with coverage continuing into 2015. These results, while 
not generalizable, nevertheless illustrate that the Marketplace enrollment process 
is vulnerable to fraud. Further, for a second round of testing — for 2015 coverage, 
and which also included two State marketplaces in addition to the Federal Market- 
place — we obtained subsidized marketplace coverage for fictitious applicants in 10 
of 10 instances.'^ 

Question. In your professional opinion, are the findings of this “secret shopper” 
activity concerning? 

Answer. As noted above, our results illustrate that the Marketplace enrollment 
process is vulnerable to fraud. A program of this scope and scale is inherently at 
risk for errors, including improper payments and fraud. Accordingly, it is essential 
that effective enrollment controls are in place to help narrow the window of oppor- 
tunity for such risk and safeguard the government’s investment. Based on our test- 


^For qualifying applicants, PPACA provides two possible forms of subsidies for consumers en- 
rolling in individual health plans, both of which are paid directly to insurers on consumers’ be- 
half. One is a Federal income tax credit, which enrollees may elect to receive in advance, and 
which reduces a consumer’s monthly premium payment. This subsidy is known as the advance 
premium tax credit. The other, known as cost-sharing reduction, is a discount that lowers the 
amount consumers pay for out-of-pocket charges for deductibles, coinsurance, and copayments. 

"^See GAO, Patient Protection and Affordable Care Act: Preliminary Results of Undercover 
Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015, 
GAO-16— 159T (Washington, DC: October 23, 2015). In addition to our 10 applications for sub- 
sidized private health plans, we also made eight additional fictitious applications for Medicaid 
coverage, in order to test the ability to apply for that program through the marketplaces. In 
these tests, we were approved for subsidized health-care coverage for seven of the eight applica- 
tions. For three of the eight applications, we were approved for Medicaid, as originally sought. 
For four of the eight applications, we did not obtain Medicaid approval, but instead were subse- 
quently approved for subsidized qualified health-plan coverage. Thus, for the second round of 
testing overall, we obtained coverage for 17 of 18 applicants. 
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ing and related work, we concluded that CMS has assumed a passive approach to 
identifying and preventing eligibility and enrollment fraud. In February 2016, we 
recommended that CMS conduct a fraud risk assessment, consistent with best prac- 
tices provided in GAO’s framework for managing fraud risks in Federal programs, 
of the potential for fraud in the process of applying for qualified health plans 
through the Federal Marketplace.® HHS concurred with our recommendation. 


Questions Submitted by Hon. Rob Portman 

Question. I am extremely concerned that a large number of enrollees in Ohio and 
across the country may be receiving coverage when they are not legally eligible to 
do so, because they have already been offered coverage through their employers. 
Many are unaware that they will owe enormous tax bills at the end of the year, 
all because HHS lacks the ability to verify whether an applicant has actually been 
offered coverage and is providing subsidies when they should not. 

That is why I introduced S. 1996, the Commonsense Reporting Act. This would 
allow employers to prospectively report to the IRS before the open enrollment period 
opens whether they are offering coverage to their employees. The government would 
definitively have this information well before enrollment begins — today, they only 
receive this information after employees may already be enrolled in coverage and 
receiving subsidies, meaning the IRS will have to claw back the money. 

Do you believe it would help make subsidy approval more accurate if IRS and 
HHS had this type of information prior to open enrollment beginning? 

Why has HHS been unable to help teix payers avoid these repayment penalties? 

Do you believe it would lower the instances of employees who are offered coverage 
from being hit with surprise tax bills because they were not eligible for the subsidies 
they received? 

Answer. We did not report on the availability of employer-sponsored insurance at 
time of enrollment, and thus we cannot offer any observations. 

Question. Your report also identifies that CMS is not tracking the extent to which 
agencies respond to individual’s inaccuracies. Can you explain how this information 
could potentially be used by CMS, if they were to track it? 

Answer. Please see the answer to Senator Grassley’s first question. As discussed 
there, by not tracking outcomes of data hub queries, CMS foregoes information that 
could suggest potential program issues or potential vulnerabilities to fraud, as well 
as information that might be useful for enhancing program management. 

Question. Wouldn’t a better system provide timely updated information about the 
availability of employer-sponsored insurance at the time of enrollment? 

Answer. We did not report on the availability of employer-sponsored insurance at 
time of enrollment, and thus we cannot offer any observations. 


Questions Submitted by Hon. Dean Heller 

Question. As of March 2016, there were 88,145 Nevadans on the Exchange, but 
only 76,821 of these enrollees have selected a plan. 

How can CMS count consumers as “enrollees” if they have not “enrolled” in a 
plan? 

What barriers exist that would have prevented nearly 12,000 Nevadans from se- 
lecting a plan? 

Answer. According to the HHS Office of the Assistant Secretary for Planning and 
Evaluation (ASPE), Nevada activity for the 2016 open enrollment period (November 
1, 2015 to February 1, 2016), as of March 2016, was as follows: 


®See GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO— 15-593SP 
(Washington, DC: July 2015). 



30 


STAGE OF APPLICATION 


NUMBER 


A. Total completed applications 

B. Total individuals applying tor coverage in completed applications 

C. Total individuals eligible to enroll in a marketplace plan 

D. Number ot individuals eligible to enroll in a marketplaoe plan with tinancial assistance 

E. Number of individuals who selected a marketplace plan 

F. Number of individuals with 2016 marketplaoe plan selections with advance premium tax credit 


93,255 

134,454 

107,525 

89,716 

88,145 

76,821 


Notes: For items A-E, tor complete details, Including explanatory notes on the figures shown, see Department of Health and Human Serv- 
ices, Office of the Assistant Secretary tor Planning and Evaluation, “Addendum to the Health Insurance Marketplaces 2016 Open Enrollment 
Period: Final Enrollment Report,” ASPE Issue Brief (March 11, 2016). For item F, tor complete details and explanatory note, see Department of 
Health and Human Services, Office of the Assistant Secretary for Planning and Evaluation, “Health Insurance Marketplaces 2016 Open Enroll- 
ment Period: Final Enrollment Report,” ASPE Issue Brief (March 11, 2016). 


Question Submitted by Hon. Michael F. Bennet 

Question. The investigation concludes that no cases of real world fraud were 
found. Did GAO take measures to identify cases of actual fraud in the scope of the 
overall investigation? 

Answer. As we said in our March 17, 2016 testimony, the purpose of our work 
was to seek to identify eligibility and enrollment control vulnerabilities, and not to 
attempt to identify actual cases of fraud. As noted above, our covert vulnerability 
testing demonstrated that the Marketplace enrollment process is vulnerable to 
fraud, as 11 of 12 applicants in our tests obtained coverage through fraudulent 
means. 


Questions Submitted by Hon. Sherrod Brown 

Question. CMS is responsible for working in collaboration with public and private 
entities — including other Federal agencies. State Medicaid agencies, private contrac- 
tors, health insurance issuers, and not-for-profit organizations — to manage the Af- 
fordable Care Act (AC A) marketplace. 

As part of its responsibilities, CMS must ensure accurate eligibility determina- 
tions, process enrollments, facilitate Medicaid enrollment for those who qualify, and 
communicate timely and accurate information to issuers and consumers. 

CMS also provides support functions for the State marketplaces and administers 
Federal financial assistance and premium stabilization programs related to the mar- 
ketplaces. 

The GAO report discusses some inconsistencies that have come up as CMS has 
balanced these priorities during a period of time where Republicans were doing ev- 
erything they could to sabotage the law’s implementation. I5ut the GAO report fails 
to acknowledge two things: 

• These inconsistencies are not indicative of any widespread fraud by real-world 
enrollees, and 

• The significant work CMS has undertaken to resolve inconsistencies by either 
eliminating coverage or adjusting an individual’s advance premium teix credit. 

Isn’t it true that, in order to correct these inconsistencies, during the first nine 
months of 2015, CMS ended the enrollments of approximately 471,000 individuals 
because they failed to properly verify their identities? 

Isn’t it also true that CMS has adjusted the tax credits of approximately 1,153,000 
households whose incomes could not be properly verified? 

Answer. We cannot comment on these figures, as CMS provided us with statistics 
covering a different period, which we included in our February 2016 report. Specifi- 
cally, according to CMS officials, from April through June of 2015, enrollment in 
coverage through the Federal Marketplace was terminated for about 306,000 con- 
sumers with citizenship or immigration status data-matching issues who failed to 
produce sufficient documentation. In addition, according to the officials, about 
735,000 households with income inconsistencies had their advance premium tcix 
credit or cost-sharing reduction subsidies adjusted for coverage year 2016. 

In February 2016, we also reported on results of a GAO analysis of application 
inconsistencies and subsequent resolutions for the 2014 coverage year. We found 
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that for a group of about 1.1 million applications with a total of about 2 million in- 
consistencies, about 34 percent of the inconsistencies, with about $1.7 billion in as- 
sociated subsidies, remained open as of April 2015 — that is, still open several 
months following the close of the 2014 coverage year. 

Otherwise, as noted above, the objectives of our work were to test enrollment con- 
trols and identify vulnerabilities, if any, and not to determine the extent of fraud 
perpetrated by actual enrollees. 

Question. Has the GAO elsewhere acknowledged the work CMS did to correct 
these inconsistencies? 

Answer. Yes, our February 2016 report (p. 34) reflects CMS’s actions on termi- 
nations and adjustments. Also in that report (beginning at pp. 17 and 45), as noted 
above, we presented results of an analysis of application inconsistencies, including 
by type of inconsistency (such as income or citizenship/immigration status) and reso- 
lution. Terminations of policies and adjustments of subsidies were among resolu- 
tions we reported. 


Prepared Statement of Erin Bliss, Assistant Inspector General for Evalua- 
tion AND Inspections, Office of Inspector General, Department of Health 

AND Human Services 

HEALTHCASE.GOV: CASE STUDY OF CMS MANAGEMENT OF THE FEDERAL MARKETPLACE 

Good morning. Chairman Hatch, Ranking Member Wyden, and other distin- 
guished Members of the Committee. I am Erin Bliss, Assistant Inspector General 
for Evaluation and Inspections in the Office of Inspector General (OIG), U.S. De- 
partment of Health and Human Services (HHS or the Department). Thank you for 
the opportunity to testify about OIG’s case study reviewing the management of the 
Federal Marketplace website HealthCare.gov by the Centers for Medicare and Med- 
icaid Services (CMS). 

OIG’s mission is to protect the integrity of HHS programs and the health and wel- 
fare of the people they serve. We advance our mission through a nationwide net- 
work of audits, evaluations, investigations, enforcement actions, and compliance ef- 
forts. OIG has identified oversight and operation of the Health Insurance Market- 
places as a Top Management Challenge for HHS. 

The case study is an important component of our marketplace oversight strategy. 
It primarily examines implementation of HealthCare.gov, the consumer-facing 
website for the Federal Marketplace, by CMS from passage of the Patient Protection 
and Affordable Care Act (ACA) in 2010 through the second open enrollment period 
in 2015. As required by the ACA, HealthCare.gov is the Federal website that facili- 
tates purchase of private health insurance for consumers who reside in States that 
did not establish health insurance marketplaces. At its highly publicized launch on 
October 1, 2013, and for some time after, HealthCare.gov users experienced substan- 
tial website outages and technical malfunctions. After corrective action by CMS and 
contractors following the launch, CMS ended the first open enrollment period with 
5.4 million individuals having selected a plan through the Federal Marketplace. 

OIG’s STRATEGY FOR OVERSIGHT OF THE MARKETPLACES 

OIG has completed and planned a significant body of audits and evaluations re- 
garding the Federal Marketplace and other ACA provisions of high interest and con- 
cern to the Department, Congress, and other stakeholders. OIG’s marketplace over- 
sight strategy focuses on four areas that we have determined to be most critical: 
payment, eligibility, management and administration, and security. 

My testimony focuses on the OIG report “HealthCare.gov: Case Study of CMS 
Management of the Federal Marketplace” (OEI-06-14-00350) released on February 
23, 2016. The case study report evaluates CMS’s implementation and management 
oiHealthCare.gov. Consistent with the OIG’s statutory purpose to promote economy, 
efficiency, and effectiveness in the administration of Departmental programs, the 
rollout of HealthCare.gov presented a unique opportunity to assess CMS’s manage- 
ment and operations. The implementation of HealthCare.gov provides lessons that 
will be increasingly important as the success of Government programs becomes 
more dependent on the effective intersection of policy, technology, and management. 
The case study enabled OIG to draw conclusions about factors that contributed to 
the website’s breakdown and subsequent improvement, and lessons learned to pro- 
mote effective Government operations moving forward. 
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In summary, our case study report provides three takeaways about the develop- 
ment and implementation of HealthCare.gov , presented in chronological order over 
a 5-year period from passage of the ACA through the Marketplace’s second open en- 
rollment period: 

Development and Launch: The poor launch of the website was caused by many 
avoidable organizational missteps, in addition to problems with website tech- 
nology; 

Correction Through Second Open Enrollment Period: After the breakdown, CMS 
improved processes and worked with contractors and others to fix the website, 
and this approach led to broader organizational changes focused on leadership, 
decisionmaking, and communication; and 

Call for Continued Progress: Challenges remain in managing the Federal Mar- 
ketplace and improving operations and services provided by HealthCare.gov, in- 
cluding issues identified in related OIG reports. CMS must continue appl3dng 
lessons learned from HealthCare.gov to complete this work and address new 
challenges as they arise. 

BACKGROUND ON THE FEDERAL MARKETPLACE AND HEALTHCARE.GOV 

The ACA was signed into law on March 23, 2010, and amended on March 30, 
2010.1 The ACA required the establishment of a health insurance exchange (mar- 
ketplace) in each State that would be operational on or before January 1, 2014.^ For 
States that elected not to establish their own marketplaces, the Federal Government 
was required to operate a marketplace on behalf of the State.® 

The marketplaces provide those seeking health insurance a single point of access 
to view qualified health plan (health plan)i options, determine eligibility for cov- 
erage, and purchase insurance coverage. Individuals also use the marketplaces to 
determine eligibility for insurance affordability programs (e.g., Medicaid, premium 
tax credits, and cost-sharing reductions) that lower insurance premiums and costs 
of care.® At the beginning of the third open enrollment period, November 1, 2015, 
the Federal Government operated a marketplace (the Federal Marketplace) for 38 
States, including 7 State-partnership marketplaces for which HHS and the State 
share responsibilities for core functions and 4 federally supported State market- 
places in which States perform most marketplace functions.® Thirteen States (in- 
cluding the District of Columbia) operated their own State marketplaces.^ 

CMS has had responsibility for managing the marketplace programs since Janu- 
ary 2011.® To implement the ACA provisions related to the marketplaces, CMS has 
worked in collaboration with public and private entities, including other Federal 
agencies as required by the ACA,® State Medicaid agencies, private contractors, 
health insurance issuers (issuers), and not-for-profit organizations. As it continues 
to operate the Federal Marketplace, CMS must ensure accurate eligibility deter- 
minations, process enrollments, facilitate Medicaid enrollment for those who qualify, 
and communicate timely and accurate information to issuers and consumers. CMS 
also provides support functions for the State marketplaces and administers Federal 
financial assistance and premium stabilization programs related to the market- 
places. 

HealthCare.gov is the public website for the Federal Marketplace through which 
individuals can browse health insurance plans, enroll in plans, and apply for Fed- 
eral financial assistance to help cover their premiums and other costs. This is the 
consumer-facing, or “front end,” portion of the marketplace. The “back end” systems 


iPub. L. No. 111—148 (March 23, 2010), as amended by the Health Care and Education Rec- 
onciliation Act of 2010, Pub. L. No. 111—152 (March 30, 2010), collectively referred to as the 
Affordable Care Act (A(1A). 

^Ibid. § 1311(a), (b). 

^Ibid. § 1321(c). 

'^Private health insurance plans certified as meeting certain standards and covering a core 
set of benefits including doctor visits, preventive care, hospitalization, and prescriptions. 

SACA §§1401, 1402. 

® The Henry J. Kaiser Family Foundation, State Decisions on Health Insurance Marketplaces 
and the Medicaid Expansion, December 17, 2015. Accessed at http:! ! kff.org ! health-reform t 
state-indicator/ state-decisions-for-creating-health-insurance-exchanges-and-expanding-medicaid I 
on January 6, 2016. CMS, Hawaii: For 2016 insurance coverage, use HealthCare.gov to apply 
and enroll. Accessed at https:! i www.healthcare.gov I hawaii-2016 1 on January 6, 2016. 

Mbid. 

s 76 Fed. Reg. 4703 (Jan. 26, 2011). 

®ACA §§1411, 1412. 
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of the Federal Marketplace perform functions such linking consumers’ information 
from HealthCare.gov to multiple supporting systems that facilitate the enrollment 
process and payment to issuers. 

Key components of HealthCare.gov and the Federal Marketplace include an iden- 
tity management system to enable consumers to create accounts and verify their 
identities; the Data Services Hub, which routes information requests from the mar- 
ketplaces to other Federal agencies and back, such as the Internal Revenue Service 
(IRS); and the Federally-facilitated Marketplace (FFM) that comprises the core of 
the overall system. The FFM includes three main subcomponents to facilitate var- 
ious aspects of acquiring health insurance: eligibility and enrollment determina- 
tions, plan management, and financial management. 

oig’s case study approach 

The objective of the case study was to gain insight into CMS implementation and 
management of the Federal Marketplace, focusing primarily on HealthCare.gov . The 
case study identifies organizational factors that contributed to the website’s poor 
launch and subsequent improvement, and lessons for employing core management 
principles in navigating program implementation and change. These organizational 
factors and the lessons learned identify principles that can contribute not only to 
improving the Marketplace, but also contribute to improving the economy, efficiency, 
and effectiveness of the Department’s other programs and operations. 

Our review examined the 5-year period from March 2010 to February 2015, pro- 
viding a chronology of events and identifying factors that contributed to the 
website’s breakdown at launch, its recovery following corrective action, and imple- 
mentation of HealthCare.gov through the second open enrollment period. In con- 
ducting this review, we interviewed current and former HHS and CMS officials, 
staff, and contractors involved with the development and management of the 
website. We also reviewed thousands of HHS and CMS documents, including man- 
agement reports, internal correspondence, and website development contracts. 

DIG FINDINGS FROM PREPARATION AND DEVELOPMENT OF HEALTHCARE.GOV 
(MARCH 2010-SEPTEMBER 2013) 

The development of HealthCare.gov faced a high risk of failure, given the tech- 
nical complexity required; the fixed deadline; and a high degree of uncertainty about 
mission, scope, and funding. Still, we found that HHS and CMS made many mis- 
steps throughout development and implementation. Most critical was the absence of 
clear leadership, which caused delays in decisionmaking, lack of clarity in project 
tasks, and the inability of CMS to recognize the magnitude of problems as the 
project deteriorated. 

The HealthCare.gov project encountered problems at the beginning of development 
that set the stage for the poor launch. Implementing the Federal Marketplace re- 
quired substantial policy development and decisionmaking to inform technical plan- 
ning and implementation of the website. This included not only writing regulations 
to govern the marketplaces, but also establishing partnerships with other entities 
involved in implementation, such as other departments, States, and issuers. This 
policy work was made more difficult and protracted by a lack of certainty regarding 
the mission, scope, and funding for the Federal Marketplace and website and by 
varying internal and external expectations for the marketplaces. Delays caused by 
the lack of certainty used valuable time and made an already compressed time 
frame more difficult. 

Additionally, the project’s poor transition to CMS after 10 months in the HHS Of- 
fice of the Secretary resulted in problems that lasted long after the move. Initial 
work in the HHS Office of the Secretary made significant strides in establishing the 
policy framework, but did not focus attention on planning for the project’s longer- 
term technical and operational needs. CMS had to reconfigure roles and timelines, 
determine how it would leverage its resources, and begin work behind schedule. 
Further, while CMS’s infrastructure and experience provided greater resources for 
the project, it led to the Federal Marketplace operating within a large bureaucratic 
structure that separated contract, policy, and technical staff, further diffusing the 
project team and making implementation more complex. Our review found that 
CMS leadership failed to foster effective collaboration and communication, particu- 
larly between CMS policy and technical staff and with contractors. 

Lack of clear project leadership led to project diffusion and poor coordination. 
From the beginning and well into the project, CMS did not assign clear project lead- 
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ership, which was particularly problematic for the policy and technological work 
needed to set up HealthCare.gov. For example, CMS continued to make changes to 
the project’s business requirements that then changed technical aspects of the 
website build, in large part because mid-level staff and managers did not have clear 
direction or the authority to make decisions. Effective leadership would have en- 
abled a comprehensive view across the project to better identify problems and deter- 
mine priorities. Instead, lack of a single lead entity inhibited progress assessments 
and changing course as needed. 

IT contraeting for the FFM encountered significant problems. CMS mismanage- 
ment of the key HealthCare.gov contract continued throughout the website build. 
CMS did not employ an acquisition strategy to develop contracts and solicit contrac- 
tors, a tool used to precisely assess project needs and make a systematic assessment 
of the contractors’ ability to meet those needs. Further, due to CMS’s contracting 
process and uncertainty about funding and specifications, CMS received a limited 
number of bids for the contract. CMS hired CGI Federal to build the core of the 
overall FFM system, as well as the online application for consumers. CMS oversight 
of the contract was disjointed and spread across different divisions with little coordi- 
nation. CMS made frequent changes to contract specifications, and did not effec- 
tively communicate these changes or adequately assess how they would affect staff- 
ing and schedules. 

Despite many warnings of substantial problems, CMS moved forward without seri- 
ous discussion of delaying the launch. Throughout the course of building Health- 
Care.gov, staff at HHS and CMS, as well as outside entities, identified problems 
with the program and warned that these problems warranted action. In all, CMS 
received 18 “documented warnings” of concerns regarding HealthCare.gov between 
July 2011 and July 2013. These documented warnings contained substantial detail 
about the project’s shortcomings and were formally submitted to CMS senior leader- 
ship or project managers at CMS. However, these reports were not shared broadly 
due to diffuse leadership and poor communication. As a result, no one person in 
CMS had a comprehensive view of the poor progress and, given the problems were 
complex, information became unwieldy and difficult to prioritize. Without a single 
comprehensive view, CMS leadership and staff took little action to respond to warn- 
ings, remained overly optimistic about the launch, and developed few contingency 
plans. As the project degraded further and problems became more well-known, CMS 
officials and staff became desensitized to bad news about progress. 

In early 2013, CMS attempted to take corrective action, but these efforts were 
largely unsuccessful because they were not fully and diligently executed. For exam- 
ple, after criticism that there was no clear leadership, CMS assigned its newly ap- 
pointed Chief Operating Officer in early 2013 to head the Federal Marketplace pro- 
gram, but the assignment was not formally announced, the position was not sup- 
ported by clear responsibilities, and the designee had an already large responsibility 
as CMS Chief Operating Officer. As another example, a CMS advisor recommended 
that the project hire a technical systems integrator to coordinate operations, and 
CMS and contractors discussed this need at several points in the project. However, 
in correspondence and congressional testimony, it was clear CMS technical leader- 
ship perceived that CMS itself was already serving as the systems integrator. CGI 
Federal managers reported that the lack of a true systems integrator created extra 
work that was outside the scope of their contract. 

Due to the poor contract management and ensuing delays, the final months of de- 
velopment and implementation for HealthCare.gov were chaotic. CMS continued to 
make changes to business requirements and technical specifications well into 2013, 
delaying development to a point where it was not feasible to complete and test the 
website as initially planned. Critical tasks went uncompleted, including testing 
website functionality and security and ensuring adequate capacity for users. CMS 
continued with the same plans for a full launch. Changing the project’s path would 
have required a leader or team to conduct a comprehensive assessment of status, 
and to either possess the authority to alter tasks and processes or to fully commu- 
nicate that assessment to leaders with authority. Instead, CMS and contractors con- 
tinued with the initial strategy and goals, falling further behind schedule, with 
largely the same diffuse leadership structure, staffing, and project plan. 

By the time CMS took more drastic action to change the project’s path in August 
and September of 2013, it was too late to adequately affect change, given the sub- 


u’U.S. House of Representatives, House Energy and Commerce Committee, PPACA Implemen- 
tation Failures: Answers from HHS, October 30, 2013. 
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stantial need for progress and improved execution. CMS cut functions that were at 
one time considered critical to a successful launch, such as the Spanish language 
and SHOP websites, to divert resources to the main build. This occurred in the last 
few weeks before launch, when developers and testers reported they were months 
behind schedule. The rush to launch affected all aspects of the build, including mov- 
ing forward with only an interim authorization to operate and requesting double 
computing capacity late in September. CMS sought to deliver a version of Health- 
Care.gov that had only the minimum necessary functions to operate, but did so 
without a comprehensive and thoughtful strategy. 

OIG FINDINGS FROM LAUNCH, CORRECTION AND TURNAROUND OF HEALTHCARE.GOV 
(OCTOBER 2013-FEBEUARY 2016) 

HealthCare.gov launched at midnight on October 1, 2013, and experienced sub- 
stantial problems within hours. The website received five times the number of ex- 
pected users, but the problems involved more than capacity. The website entry tool 
was overwhelmed, and software code defects caused malfunctions. Fixing the 
website required substantial corrections to the software code and to further increase 
capacity. Compounding problems further, some responsible staff were furloughed 
when the Government shut down on October 1, 2013. 

CMS began corrective action, reorganizing the work to focus on key priorities and 
to improve execution. CMS and contractors quickly brought in new staff and exper- 
tise following the launch, developing an all-hands environment wherein fixing prob- 
lems with HealthCare.gov was the key agency mission. Most of the additional staff- 
ing came to the project within 3 weeks, including technological and project manage- 
ment experts from CMS, contractors, and the private sector. By late October, CMS 
and contractors began to move command center operations, establishing what would 
become the formal HealthCare.gov command center — the Exchange Operations Cen- 
ter (XOC). The structure at the XOC was based on active coordination between tech- 
nical and policy staff, a key component missing during the website preparation and 
development. It also employed comprehensive website monitoring tools to identify 
problems and assess performance. The widespread attention to the launch and the 
number of parties involved could have created bureaucratic paralysis, but those 
working on the repairs directed their attention to immediate action and improved 
the HealthCare.gov website substantially in 2 months. 

Before the launch, artificial distinctions and divisions among staff contributed to 
poor collaboration, lack of communication, disjointed management, and slow prog- 
ress. Following the launch, first with the technological team and then more broadly, 
CMS promoted a culture that was “badgeless” and “titleless,” working as a single 
team regardless of employer and job title. 

According to CMS, this change in culture fostered a greater sense of mission and 
teamwork that further improved daily operations. 

CMS initiated organizational change, such as a deeper integration between policy 
and technological tasks. The Federal Marketplace and HealthCare.gov needed exper- 
tise and coordination across CMS divisions and many contractors. CMS integrated 
the various functions within the project, which improved daily work. This integra- 
tion allowed CMS to identify and address problems more quickly, make informed 
decisions, and provide clearer direction to those involved in the website development 
and operations. CMS also assigned clear project and technical leadership, hiring a 
technical systems integrator, and restructuring its divisions to allow for greater visi- 
bility and oversight of technical staff and contractors by senior leadership. 

This greater sense of “operational awareness” also prompted CMS to plan for and 
mitigate potential problems by considering contingencies, building redundant sys- 
tems, and increasing capacity. CMS’s lack of contingency plans before the launch 
meant that CMS had few options when the functionality and computing capacity of 
HealthCare.gov encountered problems. Essential to success was identifying possible 
problems and developing systems and strategies specific to each concern. 

By the end of the first open enrollment period, CMS had a stable website that 
functioned well at high capacity, but some planned components had yet to be com- 
pleted. CMS immediately began preparation for the second open enrollment period 
to begin seven months later. CMS practiced what officials called “ruthless pri- 
oritization” of tasks to focus on the most urgent needs and functionality. This strat- 
egy served to align goals with available resources, guide daily work and account- 
ability, and temper unrealistic expectations about results. According to CMS, offi- 
cials developed a list of technological needs, then debated and cut about half of the 
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items requested. Cuts included key elements of the Federal Marketplace system, 
such as completion of the automated financial management system. 

This process for strategic and organized prioritization marked a significant im- 
provement over the rushed reprioritization efforts that occurred prior to launch. 
Project documentation indicated that in 2013, CMS and contractors were frantic to 
establish basic website functionality. They pushed forward faulty and untested 
functionality and hoped to fix it after the launch. Project documentation indicated 
that in 2014, CMS maintained a more disciplined project schedule, meeting dead- 
lines with a goal to implement only technology that had what project documentation 
referred to as optimal functionality, or “perfect execution.” When this standard could 
not be met in time, CMS identified problems more quickly to allow time to employ 
contingency plans. CMS stated that this higher standard led to improved practices 
overall, such as targeting earlier deadlines for delivery and imposing stricter testing 
standards. For example, the new HealthCare.gov consumer application, App 2.0, was 
tested through a “soft launch” prior to open enrollment. This approach meant that 
CMS did not always deliver according to schedule, but was able to test the applica- 
tion’s functionality prior to use in the second open enrollment. 

CMS documentation indicated the technical aspects of the website and supporting 
systems performed well during the second open enrollment period, with no system 
outages and few consumer reports of problems applying for coverage or selecting 
plans. CMS further solidified project leadership, worked to better align project goals 
with resources, and renewed its focus on contract management, particularly empha- 
sizing the agency-contractor relationship. As of February 1, 2016, CMS reported 
that over 9.6 million consumers had selected a health insurance plan through the 
Federal Marketplace or had their coverage automatically renewed.^'^ 

CALL FOR CONTINUED PROGRESS 

CMS continues to face challenges in implementing the Federal Marketplace, and 
in improving operations and services provided through HealthCare.gov. As CMS 
moves forward, challenges include improving the website and systems as planned, 
such as completing the automated financial management system and improving con- 
sumer tools to select plans. CMS must also continue to address areas OIG has iden- 
tified in past reports as problematic or needing improvement, including contract 
oversight, the accuracy of payments and eligibility determinations, and information 
security controls. 

CMS concurred with OIG’s call for continued progress, stating that it will con- 
tinue to employ the lessons identified in the case study and that, since OIG’s review, 
it has implemented several initiatives to further improve its management. The 10 
lessons articulated in the report comprise core management principles that could 
apply to other organizations. They include assigning clear project leadership, en- 
couraging staff to identify and communicate problems, and better integrating policy 
and technological work. OlG will continue to monitor CMS’s actions to address spe- 
cific recommendations from our work, as well as its overall management of this pro- 
gram. 

In addition to the lessons learned from the case study, OIG has also completed 
12 audits and evaluations of the Federal Marketplace, which combined make over 
30 recommendations to CMS. We continue to monitor CMS’s progress toward imple- 
menting these recommendations. OIG has also published numerous other reports re- 
lated to State marketplaces and other significant programs created by the ACA. All 
of our ACA-related work is available at: http:lloig.hhs.govlreports-and-publica- 
tions local. 

OIG has ongoing and planned work in several areas related to marketplaces, in- 
cluding examining the accuracy of financial assistance payments for individual en- 
rollees for the Federal Marketplace, analysis of CMS’s oversight of the State mar- 
ketplaces, and a review of the funding that established the Federal Marketplace. We 
are also currently developing work related to the premium stabilization programs. 
In addition, OIG has established relationships with its law enforcement partners to 
investigate fraud and closely monitor activities and concerns related to the market- 
places. 


UCMS, Health Insurance Marketplace Open Enrollment Snapshot — Week 13, February 4, 
2016. Accessed at https: 1 1 www. cms.gov I Newsroom I MediaReleaseDatabase I Fact-sheets 1 2016- 
Fact-sheets-items 1 2016-02-04.html on February 8, 2016. 
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CONCLUSION 

The Department, and the health care system generally, are in the process of im- 
plementing major changes to health care delivery. Most of those changes will de- 
pend on the successful implementation of information technology, but success will 
require more than just ensuring that the right code is written or that the right tech- 
nology is purchased. As our case study demonstrates, whether these changes will 
result in more effective, efficient, and economic health care and human service pro- 
grams will depend on the interaction of technology, management, and policy. 

OIG believes the lessons learned identified in the case study may be beneficial 
to the Department beyond the operation and management of the Federal Market- 
place. Assessing Departmental management will continue to be a vital component 
of OIG’s oversight of Department programs going forward. Many programs or 
projects that OIG oversees will not require the same level of coordination or re- 
sources required of the Federal Marketplace; however, the principles identified in 
the Case Study can help foster the effectiveness and efficiency of Departmental and 
program management. 

The growing intersection of programs and technology requires OIG to grow its 
own capabilities to provide effective oversight. OIG is building necessary expertise 
in data analytics, information technology, and forensic accounting. Increasing our 
proficiencies and resources in these disciplines will allow OIG to provide meaningful 
analysis to inform decision-makers and program managers. 

Thank you again for inviting OIG to speak with the committee today to share the 
results of the case study reviewing CMS management of HealthCare.gov. I would 
be happy to submit the case study report for the record, and I would be happy to 
answer any questions the committee may have. 


Questions Submitted for the Record to Erin Bliss 
Question Submitted by Hon. Chuck Grassley 

I would like the record to show that I was unable to attend this hearing in person. 
As Chairman of the Senate Judiciary Committee, I was overseeing the debate about 
the Supreme Court vacancy. The two hearings were at the same time. 

Question. Ms. Bliss, in your recent case study report, you summarized many of 
the mistakes at HHS and CMS that resulted in the disastrous launch of Health- 
Care.gov. 

Some of the problems identified by OIG included a lack of leadership, a failure 
to act on warnings and address problems, and corrections that were too little too 
late. 

In the final countdown to the launch of HealthCare.gov, it seems CMS was more 
concerned about launching anything rather than following the advice of their own 
advisors and waiting and then releasing a product that would be useful to Ameri- 
cans. 

CMS continues to have problems with implementing and operating the Federal 
Marketplace. 

Ms. Bliss, what are the 10 lessons CMS should have learned? 

Answer. The Centers for Medicare and Medicaid Services (CMS) continue to face 
challenges in implementing the Federal Marketplace and in improving services pro- 
vided through HealthCare.gov. The HHS OIG called on CMS to continue progress 
in applying lessons learned from HealthCare.gov to avoid future problems and to 
maintain improvement across the agency. These 10 lessons comprise core manage- 
ment principles that address both specific project challenges and organizational 
structure, and could apply to other organizations. 

1. Assign clear project leadership for cohesion across tasks and a comprehensive 
view of progress. 

2. Align project and organizational strategies with the resources and expertise 
available. 

3. Identify and address factors of organizational culture that may affect project 
success. 

4. Seek to simplify processes, particularly for projects with a high risk of failure. 
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5. Integrate policy and technological work to promote operational awareness. 

6. Promote acceptance of bad news and encourage staff to identify and commu- 
nicate problems. 

7. Design clear strategies for disciplined execution and continually measure 
progress. 

8. Ensure effectiveness of information technology (IT) contracts by promoting in- 
novation, integration, and rigorous oversight. 

9. Develop contingency plans that are quickly actionable, such as redundant and 
scalable systems. 

10. Promote continuous learning to allow for flexibility and changing course 
quickly when needed. 

CMS concurred with OIG’s call for continued progress and stated that it will con- 
tinue to employ the lessons. Since OIG’s review, CMS has implemented several ini- 
tiatives to further improve its management. 


Questions Submitted by Hon. Michael B. Enzi 

Question. In the hearing, some of the operational and strategic changes which 
were made after the first enrollment period were briefly discussed. Those changes 
were described as “clearer leadership amongst staff and contractors,” and “key orga- 
nizational changes.” 

Please list and describe the specific changes made to make the leadership 
amongst HHS staff and contractors more clear. 

Answer. Assigning and supporting clear project leadership was perhaps the most 
critical change CMS made to improve HealthCare.gov project management. Prior to 
the launch, HealthCare.gov lacked clear project leadership to give direction and 
unity of purpose, responsiveness in execution, and a comprehensive view of prog- 
ress. CMS and its contractors took a number of steps to improve leadership, includ- 
ing the following: 

1. Tasked top agency management to assume daily leadership of the Health- 
Care.gov project, first the CMS Administrator and subsequently the Principal 
Deputy Administrator. This served to provide project visibility across agency 
functions and clear authority to implement changes. Following the website re- 
covery and before the start of the second open enrollment period, CMS hired 
a Marketplace CEO to serve in that leadership role. CMS senior leaders also 
alternated as the website’s Executive on Call, serving 24-hour shifts to make 
decisions more rapidly. 

2. Improved the coordination and transparency of work shared among CMS staff 
and multiple contractors by hiring a systems integrator to organize techno- 
logical tasks and report progress and problems to leadership. CMS continues 
to employ a contractor to serve as systems integrator, having established this 
position within weeks of the launch in late October 2013. 

3. Promoted coordination of CMS divisions working on various aspects of the Fed- 
eral and State-based marketplaces by forming the Strategic Planning and Man- 
agement Council, composed of five workgroups: appeals; eligibility and enroll- 
ment; plan oversight; security and privacy; and workforce planning. 

4. Shifted from following known processes to continually assessing outcomes and 
progress. For example, CMS identified a number of problems in the lead-up to 
the second open enrollment through “deep dives,” assigning staff to scrutinize 
the performance of a specific area or function (such as eligibility) and bring to 
CMS leadership their assessments of weaknesses. 

5. Focused on blending the policy and technical components of CMS with a great- 
er sense of what CMS leaders called “the physics of operations” or “operational 
awareness.” Policymakers acquired a better understanding of the effort re- 
quired to effectuate policy decisions, both in terms of time and resources, so 
that those considerations could better inform decision making and avoid a long- 
standing agency bifurcation between operations and policy. 

6. Instructed staff coordinating technological work and supervising contracts 
about rules and provisions related to contracted work; also instructed contrac- 
tors to work more collaboratively with each other and the CMS divisions. This 
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served to avoid staff concerns about violating Government contracting rules, 
promoting closer collaboration and a sense that CMS and contractors were a 
single team working toward the same goals. 

Question. Please list and describe the key organizational changes mentioned by 
Ms. Erin Bliss. 

Answer. CMS also made other key organizational changes as it improved the 
HealthCare.gov website. This required significant and focused effort to measure 
website performance, correct problems with website capacity and functions, and es- 
tablish a new project structure. To implement these practices, CMS and its contrac- 
tors took the following steps: 

1. Began correction of website problems immediately following launch, changing 
the project management strategy. CMS and contractors brought in new staff 
and expertise following the launch, developing an all-hands environment 
wherein fixing problems with HealthCare.gov was the key agency mission. 
These changes allowed CMS to make quick progress in identifying the source 
of problems and developing a strategy going forward. 

2. Adopted a “badgeless” culture that encouraged full collahoration hy CMS staff 
and contractors regardless of employer status and job title, fostering innova- 
tion, problem solving, and communication among teams. The enhanced team 
of CMS staff, contractors, and technological experts correcting problems with 
HealthCare.gov included people at all levels of CMS and contracted entities 
with varied experience on the project. First with the technological team and 
then more broadly, CMS promoted a culture wherein all team members could 
speak out about problems and develop creative solutions. 

3. Integrated all functions into the organizational structure to align with project 
needs, enhancing CMS and contractor accountability and collaboration. The 
Federal Marketplace needed expertise and personnel across CMS, including 
policy, technical, and communications staff, as well as many contractors. Key 
to the correction, CMS integrated the various functions both operationally and 
technically, improving daily work and promoting the larger project mission. 
This integration allowed CMS to identify and address problems more quickly, 
make informed decisions, and provide clearer direction to those involved in the 
website development and operations. 

4. Planned for problems, establishing redundant (backup) systems in the event of 
further breakdowns and restructuring the key development contract to ensure 
better performance. CMS began to plan for and mitigate potential problems by 
considering contingencies, building redundant systems, and increasing capac- 
ity. Given limited resources, CMS leadership had to analyze past problems 
with HealthCare.gov and carefully consider how and to what extent it would 
develop new systems and strategies, such as enhancing training for call center 
staff. Key to success was identifying all possible problems and developing sys- 
tems and strategies specific to the concern. 

5. Adopted a policy of “ruthless prioritization” to reduce planned website func- 
tionality, focusing resources on the highest priorities. Because the time frame 
and resources available to prepare for the second open enrollment period were 
fixed, CMS focused on reducing scope to meet deadlines. The day after first 
open enrollment closed, CMS leadership met to prioritize tasks to focus on the 
most urgent needs and functionality. These decisions and resulting changes 
were then locked down and measured for progress and results. Ruthless 
prioritization served to align goals with the resources available, guide daily 
work and accountability, and temper unrealistic expectations about results. 

6. Prioritized quality over on-time delivery, employing extensive testing to iden- 
tify and fix problems and delaying new website functionality if unready. CMS 
adopted a project management approach of going live with website func- 
tionality only when it could ensure what one CMS official called “perfect execu- 
tion.” This policy of requiring optimal functioning before delivery led to im- 
proved practices overall, such as targeting earlier deadlines for delivery and 
imposing stricter testing standards. 

7. Simplified systems and processes to enable closer monitoring of progress, in- 
creased transparency and accountability, and clearer prioritization. CMS sim- 
plified both technical aspects of the build and the organizational structure of 
the agency itself by closely monitoring progress and results with daily reports 
and close communication with contractors. Reduced complexity in tasks and or- 
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ganizational structure made it easier for CMS to identify those responsible for 
carrying out tasks and to track progress toward goals. 

8. Adopted continuous learning for policy and technological tasks, balancing 
project plans with system and team capacity and changing course as needed 
to improve operations. In preparation for the second open enrollment period, 
much about the HealthCare.gov project was still unfolding. For example, CMS 
did not know how much website capacity consumers would require, and it was 
still developing and testing new and improved functionality in the final weeks 
before open enrollment. Given that the design and proportion of the project 
was evolving, it was critical to CMS’s success that the organization continu- 
ously learn as the project progressed. As the HealthCare.gov project matured, 
CMS’s knowledge and experience became more concrete and its planning more 
effective, but the project continued to require adaptation. 

Question. In the hearing, Ms. Bliss was asked whether or not the office of Inspec- 
tor General had uncovered, in connection with open enrollment, any confirmed cases 
of fraud. Ms. Bliss responded that there are no fraudulent cases which have resulted 
in criminal convictions or civil settlements. However, she did mention that there are 
some ongoing investigations. 

How many “ongoing investigations” remain since the first open enrollment period? 

Answer. At this time, OIG has two ongoing investigations specifically looking at 
enrollment fraud in the Federally Facilitated or State-Based Marketplaces. The con- 
duct under investigation may involve more than one open enrollment period. 

Question. There have been concerns about the “back end” of the HealthCare.gov 
website, specifically as it concerns subsidy payments to insurance companies. 

Please describe the process in which insurers receive payments of subsidies for 
premiums and out-of-pocket expenses. 

Answer. To date, OIG has performed two audits that specifically examine the 
“back end” of the HealthCare.gov website. ^ These reports examine the interim man- 
ual pa 3 Tnent process that CMS utilized during the first 2 years of Marketplace oper- 
ations. In both reports, OIG found deficiencies that limited the effectiveness of the 
interim manual payment process. Please see these reports for detailed explanations 
of the interim process. 

In response to these reports, CMS explained that it expected all issuers on the 
Federal Marketplace would be using an automated policy-based system in 2016. In 
December 2015, CMS issued guidance related to issuer implementation of the auto- 
mated policy-based system.^ According to this policy, issuers are expected to transi- 
tion to this system in early 2016. CMS has provided training regarding the new sys- 
tem, which OIG attended to gain a better understanding as CMS continues to work 
with issuers to implement automated policy-based payments. 

We also plan to conduct work on CMS’s automated policy-based payments system 
at the Federal Marketplace potentially by looking at the accuracy of the determina- 
tion of financial assistance payments and the use of enrollment and payment data. 
The CMS Center for Consumer Information and Insurance Oversight (CCHO) would 
be the best source of information about specific details of this process. 

Question. What steps have been taken to ensure that those individuals who have 
signed up for a plan on the HealthCare.gov website end up in the right plan? 

Answer. To date, OIG has not conducted work specifically assessing internal con- 
trols at HealthCare.gov that would ensure individuals are enrolled in the Qualified 
Health Plan they select. 

Based on our related work on the interim manual payment process, controls for 
confirming enrollment may be included in the initial and confirmation “834” trans- 


^HHS OIG, CMS’s Internal Controls Did Not Effectively Ensure the Accuracy of Aggregate Fi- 
nancial Assistance Payments Made to Qualified Health Plan Issuers Under the Affordable Care 
Act (A-02-14-02006) (June 2015); and HHS OIG, CMS Could Not Effectively Ensure That Ad- 
vance Premium Tax Credit Payments Made Under the Affordable Care Act Were Only for Enroll- 
ees Who Paid Their Premiums (A-02— 14-02025) (December 2015). Available at http: I j 
www.oig.hhs.gov / reports-and-publications / aea I . 

2 HHS CMS, “Policy-Based Payments Bulletin — INFORMATION” (December 2015). Available 
at https: ! / www.cms.gov / CCIIO ! Resources I Regulations-and-Guidance (Downloads (Policy-based 
-Payment-Guidance.pdf. 
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actions.^ OIG’s audits did not assess the 834 transactions with respect to this spe- 
cific issue, and the automated policy-based pa3unent system may utilize different 
processes. Due to those considerations, CMS-CCIIO would be the best source of in- 
formation about specific internal controls the Federal Marketplace has in place to 
ensure individuals are enrolled in the plans they select. 

Question. Please describe the process of adding new information, like the birth of 
a child or marriage to an existing plan. 

OIG has not assessed the process for adding information to an existing plan. The 
HealthCare.gov website provides instructions for consumers to report information 
about life changes through their Marketplace accounts online or by phone. CMS- 
CCIIO would be the best source of further information about this process. 


Questions Submitted by Hon. Michael F. Bennet 

Question. As HHS and CMS concur with and move toward implementing OIG rec- 
ommendations, how can you continue to be a resource to the agency based on your 
findings? 

Answer. OIG believes that our case study’s assessment of the intersection of tech- 
nology, policy, and management, and the lessons that we identified can benefit a 
broad range of Federal projects and programs. These lessons comprise core manage- 
ment principles that address both specific project challenges and organizational 
structure and can be applied broadly. 

We will continue to monitor CMS’s actions in response to our recommendations 
and its overall management of the Federal Marketplace and other programs. OIG 
has ongoing and planned work in several areas related to Marketplaces, including 
examining the accuracy of financial assistance payments for individual enrollees for 
the Federal Marketplace, analysis of CMS’s oversight of the State Marketplaces, 
and a review of the funding that established the Federal Marketplace. We are also 
developing work related to the premium stabilization programs. In addition, OIG 
has established relationships with its law enforcement partners to investigate fraud 
related to the Federal Marketplace and make appropriate referrals to partner agen- 
cies. OIG will also draw upon these lessons to examine HHS’s and CMS’s implemen- 
tation and management of other programs. 

Question. The OIG Case Study report published in February 2016 highlights 
changes that CMS underwent including realignment of project goals and resources 
as well as enhancing coordination between CMS staff and contractors. What are the 
main operational changes that CMS should focus on as they work toward optimizing 
the Federal Marketplace? 

Answer. In addition to the lessons learned from the case study, OIG has also com- 
pleted 12 audits and evaluations of the Federal Marketplace, which combined make 
over 30 recommendations to CMS."^ We continue to monitor CMS’s progress toward 
implementing these recommendations. OIG has also published numerous other re- 
ports related to State Marketplaces and other significant programs created by the 
ACA.5 

With regard to the Federal Marketplace, in particular, successful implementation 
of the automated policy-based payment system is one of the main operational chal- 
lenges facing CMS in 2016. Additionally, CMS must continue to refine the eligibility 
determination systems for the Federal Marketplace to improve the accuracy and 
timeliness of those determinations, and continue to focus on resolving inconsist- 
encies in eligibility determinations. 

In general, as CMS improves the consumer-facing enrollment process for Health- 
Care.gov, CMS must continue to assess and improve the Federal Marketplace sys- 


^For more information about the 834 transaction process, see OIG’s report CMS’s Internal 
Controls Did Not Effectively Ensure the Accuracy of Aggregate Financial Assistance Payments 
Made to Qualified Health Plan Issuers Under the Affordable Care Act (A— 02-14— 02006) (June 
2015), pp. 6-7. 

’^For a list of significant unimplemented recommendations related to OIG’s work on both the 
Federal and State-based marketplaces, see HHS OIG, Compendium of Unimplemented Rec- 
ommendations (April 2016), pp. 34-40. Available at http: !! oig.hhs.gov ! reports-and-publica- 
tions I compendium I index, asp. 

^All of OIG’s ACA-related work is available at http: I loig.hhs.gov/reports-and-publicationsl 
aeaf. 
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terns that operate behind the scenes, particularly the eligibility, administrative, and 
financial management functions. CMS must ensure that all pathways for enrollment 
operate with integrity and that consumers’ personal information is secure. Vigilant 
monitoring and testing and rapid mitigation of identified vulnerabilities are essen- 
tial. Attention must be paid to sound operation of financial assistance and the risk 
corridor, reinsurance, and risk-adjustment programs. CMS must ensure that con- 
sumers and issuers receive accurate Marketplace information, including information 
relevant for tax purposes, such as Form 1095A tax forms. Furthermore, Market- 
places must continue to protect personally identifiable information and strengthen 
security controls. 


Questions Submitted by Hon. Sherrod Brown 

Question. We know that HealthCare.gov had a rocky start. But — as was acknowl- 
edged in the HHS OIG report — after just 2 months (during which a wholly prevent- 
able government shutdown occurred, furloughing relevant members of staff), the 
Centers for Medicare and Medicaid Services (CMS) managed to “substantially” im- 
prove the website. 

By the end of the first open enrollment period, CMS had a website that functioned 
at high capacity. The agency ended the first open enrollment period with 5.4 million 
individuals having selected a plan through the Federal Marketplace. 

Ms. Bliss, what corrective actions were taken by CMS and contractors following 
the website’s launch to address the lack of communication and leadership challenges 
that existed during the first enrollment period? 

Answer. Assigning and supporting clear project leadership was perhaps the most 
critical change CMS made to improve HealthCare.gov project management. Prior to 
the launch, HealthCare.gov lacked clear project leadership to give direction and 
unity of purpose, responsiveness in execution, and a comprehensive view of prog- 
ress. To improve project leadership, top CMS leadership assumed daily management 
of the HealthCare.gov project, first the CMS Administrator and later the Principal 
Deputy Administrator. This served to provide a view across agency functions and 
clear authority to implement changes. Following the website recovery and before the 
start of the second open enrollment period, CMS hired a Marketplace CEO to serve 
in that role and coordinate project activities across the agency. CMS senior leaders 
also alternated as the website’s Executive on Call, serving 24-hour shifts to make 
decisions more rapidly. 

CMS also worked to improve the coordination and transparency of work shared 
among CMS staff and multiple contractors. These efforts included hiring a systems 
inte^ator to organize technological tasks and report progress and problems to lead- 
ership and merging the work of policy and technical staff more closely to allow for 
a better sense of the work needed to complete project goals and integrate CMS staff 
and contractors into a single team. CMS also promoted coordination of CMS divi- 
sions working on various aspects of the Federal and State-based marketplaces by 
forming the Strategic Planning and Management Council, comprising subject area 
workgroups such as health plan oversight and workforce planning. This improved 
coordination across divisions allowed CMS to shift from separated, engrained proc- 
esses to continually assessing outcomes and progress. 

CMS made other key organizational changes as it improved the HealthCare.gov 
website. Following the poor launch, CMS and contractors pivoted quickly to correc- 
tive action, reorganizing the work to focus on key priorities and improve execution. 
These efforts benefited from CMS adopting a “badgeless” culture that encouraged 
full collaboration by CMS staff and contractors regardless of employer status and 
job title, fostering innovation, problem solving, and communication among teams. 
The agency also planned for problems, establishing redundant (backup) systems in 
the event of further breakdowns and restructuring its key development contract to 
ensure better performance. 

Question. What has CMS done to address these challenges and continue to im- 
prove operations through the second and third open enrollments? How do you antici- 
pate CMS will build upon these improvements for the upcoming open enrollment pe- 
riod? 

Answer. In preparation for the second open enrollment period, CMS restructured 
project tasks to set more realistic goals and meet core objectives. For example, CMS 
managers met immediately following the first open enrollment to “ruthlessly 
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prioritize” remaining tasks and focus resources on the highest priorities. This served 
to align goals with the resources available, guide daily work and accountability, and 
temper unrealistic expectations about results. CMS also prioritized quality over on- 
time delivery, employing extensive testing to identify and fix problems and dela3dng 
new website functionality if unready for perfect execution. This contrasted with the 
launch of HealthCare.gov wherein CMS delivered what it knew was faulty func- 
tionality, planning to improve the website later. 

To manage these efforts, CMS simplified systems and processes to enable closer 
monitoring of progress, increased transparency and accountability, and clearer 
prioritization. Reduced complexity in tasks and organizational structure made it 
easier for CMS to identify those responsible for carr3dng out tasks and to track 
progress toward goals. At the same time, the broader CMS organization adopted a 
strategy of continuous learning for policy and technological tasks, balancing project 
plans with system and team capacity and changing course as necessary to improve 
operations. Given that the design and proportion of the HealthCare.gov project was 
evolving, it was critical to CMS’s success that the organization continuously learned 
as the project progressed. CMS continued these strategies, experiencing few tech- 
nical problems and no system outages during the second open enrollment period. 

Still, the agency faces ongoing challenges in implementing the Federal Market- 
place and in improving operations and services provided through HealthCare.gov. 
OIG called on CMS to continue progress in applying lessons learned from Health- 
Care.gov to avoid future problems and to maintain improvement across the agency. 
As CMS moves forward, challenges include improving the website and systems as 
planned, such as completing the automated financial management system and im- 
proving consumer tools to select plans. Also, given CMS’s large organization and 
complex mission, prior management problems could resurface and new problems 
could emerge. CMS placed intense organizational focus on the Federal Marketplace 
during the recovery of the website. This level of focus will, by necessity, change in 
the face of new challenges and priorities within CMS, and inevitably officials and 
staff with key expertise and deep knowledge of the Federal Marketplace will leave 
CMS or the project. Such changes in priorities and resources reinforce the need for 
CMS to fully embed core management principles in its daily work. 

In its comments in response to the Case Study, CMS concurred with OIG’s call 
for continued progress in applying the lessons that CMS learned from the Health- 
Care.gov recovery in its management of the Federal Marketplace and CMS’s broader 
organization. CMS stated that since the OIG review it has implemented several ini- 
tiatives to improve its management, striving to incorporate principles aligned with 
this report’s lessons learned in its culture, operations, and daily work. These prin- 
ciples include a focus on leadership and accountability, continuous reevaluation of 
priorities and how the project could be more efficient, program measurement, and 
a flexible and evolving IT strategy aligned with policy requirements. CMS also indi- 
cated a commitment to overcoming challenges and deliver results in a transparent 
manner. OIG will continue to monitor CMS operation and management of the Fed- 
eral and State-based Marketplaces and HealthCare.gov, focusing on oversight of crit- 
ical aspects such as the integrity of enrollment processes and payment accuracy. 


Prepared Statement of Hon. Orein G. Hatch, 

A U.S. Senator From Utah 

WASHINGTON — Senate Finance Committee Chairman Orrin Hatch (R-Utah) today 
delivered the following opening statement at a hearing examining deficiencies with 
HealthCare.gov and the current state of the Patient Protection and Affordable Care 
Act (PPACA) and how it is impacting patients and teixpayers: 

Good morning. It is a pleasure to welcome everyone to today’s hearing. 

Today, we’ll be talking with representatives from the Office of Inspector General 
for the Department of Health and Human Services (HHS-OIG) and from the Gov- 
ernment Accountability Office (GAO) about their ongoing oversight work with re- 
spect to HealthCare.gov and enrollment in the Federal health insurance market- 
place. I want to thank both entities for their hard work on these issues and ac- 
knowledge the contributions both have made to help this committee perform more 
accurate and timely oversight. 

Now, it is no secret that I have never been a fan of the so called Affordable Care 
Act. And, as we approach the sixth anniversary of this law and look closely into how 
it’s working and being implemented, the evidence overwhelmingly shows that I — 
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and the many others who opposed the law from the beginning — have been right all 
along. 

The facts speak for themselves. 

Since Obamacare was signed into law, HHS-OIG and GAO have cumulatively re- 
leased at least six dozen reports detailing various operation and implementation 
issues demonstrating the numerous areas where the law is falling short. These re- 
ports are specific and focused on key operational failures like enrollment controls 
or system issues, some of which well hear more about today. 

Let’s keep in mind that GAO and HHS-OIG are not partisan entities. They are 
independent watchdogs, tasked with the responsibility of objectively and dispassion- 
ately assessing what is and what is not working in various Federal programs, in- 
cluding those created or amended by the Affordable Care Act. And, there is no bet- 
ter record showing how and why Obamacare is not working than the reports we’ve 
received from these offices. 

Today, we are going to specifically discuss operations issues related to Health- 
Care.gov and enrollment problems at the Federal insurance marketplace, otherwise 
known as the Federal exchange. 

Let’s start with the HealthCare.gov launch. 

As a result of numerous problems and shortcuts taken with the initial develop- 
ment and deployment of HealthCare.gov and its supporting systems, consumers en- 
countered widespread performance issues when trying to create accounts and enroll 
in health plans. After numerous inquiries and reports, we now know what ulti- 
mately caused these performance issues. 

For example, there was inadequate capacity planning. The Centers for Medicare 
and Medicaid Services (CMS) cut corners and did not plan for adequate capacity to 
maintain HealthCare.gov and its supporting systems. 

There were also problems with the software that were entirely avoidable. CMS 
and its contractors identified errors in the software coding for the website, but did 
not adequately correct them prior to launch. 

We saw a lack of functionality as CMS did not adequately prepare the necessary 
systems and functions of the website and its supporting systems prior to the initial 
launch. 

CMS also failed to apply recognized best practices for system development, which 
contributed to the problems. 

Admittedly, since the initial launch, CMS has taken steps to address these prob- 
lems, including increasing capacity, requiring additional software quality reviews, 
and awarding a new contract to complete development and improve the func- 
tionality of key systems. 

However, many of the problems have still not been entirely resolved and continue 
to cause frustration for consumers trjdng to obtain health insurance. 

I wish we could boil down all of Obamacare’s problems to the functions of a single 
website. Indeed, if this was just an IT problem, all of our jobs would be a lot easier. 
However, the problems with Obamacare — and the Federal insurance marketplace in 
particular — go much deeper and many of them remain unaddressed. 

We know, for example, that the enrollment controls for the Federal marketplace 
have been inadequate. 

During undercover testing by GAO, the Federal marketplace approved insurance 
coverage with teixpayer-funded subsidies for eleven out of twelve fictitious phone or 
online applicants. In 2014, the GAO applicants — which, once again, were fake, 
made-up people — obtained a total of about $30,000 in annual advance premium tax 
credits, plus eligibility for lower insurance costs at the time of service. These ficti- 
tious enrollees maintained subsidized coverage throughout the year, even though 
GAO sent either clearly fabricated documents or no documents at all to resolve ap- 
plication inconsistencies. 

While the subsidies, including those granted to GAO’s fictitious applicants, are 
paid to health-care insurers, they nevertheless represent a benefit to consumers and 
a cost to the government. Now, GAO did find that CMS relies on a contractor 
charged with document processing to uncover and report possible instances of fraud. 
Yet, GAO also found that the agency does not require that the contractor has any 
fraud detection capabilities. 
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And, according to GAO, CMS has not performed a single comprehensive fraud risk 
assessment — a recommended best practice — of the Obamacare enrollment and eligi- 
bility process. Until such an assessment is completed, CMS is unlikely to know 
whether existing control activities are suitably designed and implemented to reduce 
inherent fraud risk to an acceptable level. 

In other words, CMS isn’t even sure if CMS’s fraud prevention systems are de- 
signed correctly or if they’re effective. 

Lastly, while it is not the focus of the reports that will be covered by the testi- 
mony today, another matter we’ve been tracking closely, and where the GAO is 
issuing a report today, is CMS’s oversight of the health care CO-OPs. We had a 
hearing on this topic in late January where we examined a number of financial and 
oversight related explanations for the abject failure of the CO-OP program. 

Today’s GAO report describes CMS’s efforts to deal with financial or operations 
issues at the CO-OPs, including the use of an escalation plan for CO-OPs with seri- 
ous problems that may require corrective actions or enhanced oversight. 

As of November 2015, 18 CO-OPs had enough problems that they had to submit 
to a CMS escalation plan, including nine that have discontinued operations. And, 
just this week, we heard that yet another CO-OP, this time the one in Maine, is 
on the verge of financial insolvency, despite the fact that it had been on a CMS- 
mandated escalation plan. 

In other words, CMS’s efforts to address all the problems faced by CO-OPs ap- 
pear to have failed, just like virtually every other element of this program. 

The failure of CMS to adequately implement the CO-OP program is well- 
documented here on the Finance Committee and elsewhere. As with so many other 
parts of Obamacare, the high-minded rhetoric surrounding this program has fallen 
short of reality. 

With nearly half of the CO-OPs now closed, the failed experiment has wasted tax- 
payer dollars and forced patients and families to scramble for new insurance. With 
so many CO-OPs now in financial jeopardy, I believe that CMS should work with, 
not against States, to safeguard teixpayer dollars. 

So, as always, we have a lot to discuss. And I look forward to hearing more from 
the officials we have testifying here today. 


Prepared Statement of Hon. Ron Wyden, 

A U.S. Senator From Oregon 

It is old news that the rollout of HealthCare.gov 3 years ago was botched. It is 
new news that the Inspector General of HHS recently said, quote, “CMS recovered 
the HealthCare.gov website for high consumer use within 2 months, and adopted 
more effective organizational practices. . . .” 

That quote comes from one of two reports looking back at 2013 and 2014 that the 
Finance Committee will be presented with today. Let’s recognize that the story here 
is well-documented. After the launch went badly, some of the best minds in tech 
and a new contractor were brought in, they scrambled to overhaul the system, and 
the exchange was soon up and running. And CMS is following up on every one of 
the Inspector General’s recommendations, which the IG notes in its report. 

In the most recent enrollment period, nearly 10 million Americans used Health- 
Care.gov to sign up for a plan or re-enroU automatically. 

And in my home State, which has had its own problems, close to 150,000 people 
have used the website to sign up for a plan as of January 31st. That’s up by more 
than 30 percent compared to last year. 

The committee will also hear an update today from the Government Account- 
ability Office on what’s called a “secret shopper” investigation. GAO first brought 
this study before the committee in July last year. And I’ll repeat now what I said 
back then: On this side of the aisle, we don’t take a back seat to anybody in fighting 
fraud and protecting taxpayer dollars. One dollar ripped off is one dollar too many. 
But let’s recognize that what was true last summer remains true today. This GAO 
investigation has not uncovered one single shred of real-world fraud in the insur- 
ance marketplaces. It was built on fictitious characters with specially-created identi- 
ties, not real consumers or real fraudsters. 
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It’s true the GAO found that there are sometimes differences between the infor- 
mation on somebody’s insurance application and their tax forms and citizenship 
records. But when it comes to these inconsistencies in people’s data, this investiga- 
tion can’t differentiate between fraud and a typo. 

And meanwhile, HHS does not look the other way when it finds these red flags. 
In 2014, the year of GAO’s investigation, CMS closed more than 100,000 insurance 
policies because documents didn’t match or weren’t provided. Teix credits were ad- 
justed for nearly 100,000 households. In 2015, HHS closed more policies and ad- 
justed more tax credits. If you come at this from the left, you might say that’s too 
harsh. If you come at it from the right, you might take a Afferent view. But there 
is no basis whatsoever for the argument that HHS ignores problems in people’s 
records or leaves the door open to fraud. 

So in closing, rather than rehashing old news. I’d prefer to look at the facts. Be- 
cause of the ACA, the number of Americans without health insurance is at or near 
its lowest point in half a century. For the 160 million people who get their insurance 
from their employer, premiums climbed only 4 percent last year. Working-age Amer- 
icans in Oregon and nationwide with preexisting conditions — 80 million people or 
more — can no longer be denied insurance. 

Now, instead of battling it out over what happened 3 years ago, let’s start pulling 
on the same end of the rope and solve some real problems. For example. Democrats 
and Republicans ought to be working together to stoke more competition in the in- 
surance marketplace and bring costs down for consumers. 

Next, there are going to be spectacular, new cures available in the future, and 
there are real questions as to whether our health care system will be able to afford 
them. Senator Grassley and I put together a bipartisan case study that looked into 
one such drug, which treats Hepatitis C. Solving this issue of blockbuster drug costs 
is going to take a lot of hard work on a bipartisan basis. 

Congress also has a duty to take Medicare’s historic guarantee and reinforce it 
for a new generation of Americans. In my view, it starts with revolutionizing the 
way Medicare handles caring for seniors with chronic conditions like diabetes, can- 
cer and Alzheimer’s. Members on both sides of this committee, thanks to steadfast 
work by Senators Warner and Isakson, and Chairman Hatch’s leadership, have built 
a bipartisan game plan for chronic care. And it’s my hope that the committee is able 
to continue its progress on that front. 

Those are the kind of health care challenges I believe this committee should be 
focused on tackling. With that, I want to thank our witnesses for being here today. 
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